# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-10-30 03:18:02 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (havess) [71.229.43.123]:47384: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.208
country_id: 2186224
description:
2025-10-30 03:18:33 dovecot_login authenticator failed for ([121.73.163.208]) [121.73.163.208]:45346: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.190.214.241
country_id: 1643084
description:
Oct 30 03:18:42 host2 sshd[1917418]: Disconnected from invalid user t 103.190.214.241 port 41612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-10-30 03:21:28 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:37864: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-10-30 03:23:14 dovecot_plain authenticator failed for (evastler) [65.20.143.159]:52779: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Oct 30 03:23:31 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<vWrJKVNCDodChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 03:26:05 host2 sshd[1924425]: Disconnected from invalid user user 2.57.121.25 port 17133 [preauth]


plugin: ossec
rule: 2840
description: Oct 30 03:28:01 host2 CROND[1925991]: (root) CMD (/usr/bin/CSPUpdate -u Imunify360 &>/dev/null)
name:
Possible fraud IM360 install. Please, contact support for details https://cloudlinux.zendesk.com/hc/en-us/requests/new


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-10-30 03:27:23 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:34033: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-10-30 03:29:24 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:57482: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.143
country_id: 6252001
description:
Oct 30 03:30:06 host2 pure-ftpd[1927771]: (?@195.184.76.143) [INFO] New connection from 195.184.76.143


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.140
country_id: 6252001
description:
Oct 30 03:30:06 host2 pure-ftpd[1927766]: (?@195.184.76.140) [INFO] New connection from 195.184.76.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-10-30 03:31:59 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:54122: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2025-10-30 03:32:48 dovecot_login authenticator failed for ([49.124.154.172]) [49.124.154.172]:44216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.224
country_id: 6252001
description:
Oct 30 03:36:00 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.224, lip=66.85.158.92, session=<TjF8VlNCkiSs7OTg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.77.161.183
country_id: 2802361
description:
Oct 30 03:37:27 host2 pure-ftpd[1934128]: (?@34.77.161.183) [INFO] New connection from 34.77.161.183


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 03:40:19 host2 sshd[1936663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-10-30 03:46:08 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (eplase) [73.224.171.101]:40202: 535 Incorrect authentication data (set_id=maximsholdings@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Oct 30 03:47:21 host2 sshd[1944473]: Disconnected from invalid user deysi 89.126.208.241 port 47320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Oct 30 03:48:49 host2 sshd[1945877]: Disconnected from invalid user piotlins 89.126.208.241 port 52844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-10-30 03:49:11 dovecot_plain authenticator failed for (neancerser) [12.182.125.210]:48956: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Oct 30 03:50:11 host2 sshd[1947170]: Disconnected from invalid user gannont 89.126.208.241 port 58358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Oct 30 03:51:35 host2 sshd[1948386]: Disconnected from invalid user mlonigro 89.126.208.241 port 35644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.249.175.243
country_id: 298795
description:
2025-10-30 03:56:09 dovecot_login authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [88.249.175.243]:53566: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-10-30 03:56:41 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:33926: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-10-30 03:58:50 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:56573: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-10-30 03:59:05 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:59108: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.8.153.46
country_id: 2017370
description:
Oct 30 04:00:21 host2 sshd[1956776]: Disconnected from invalid user webmaster 46.8.153.46 port 43902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.153
country_id: 1733045
description:
2025-10-30 04:05:09 dovecot_login authenticator failed for ([49.124.154.153]) [49.124.154.153]:37122: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Oct 30 04:07:03 host2 pure-ftpd[1963181]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.87
country_id: 1733045
description:
2025-10-30 04:07:13 dovecot_login authenticator failed for ([49.125.201.87]) [49.125.201.87]:43070: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.8.153.46
country_id: 2017370
description:
Oct 30 04:07:41 host2 sshd[1963566]: Disconnected from invalid user sara 46.8.153.46 port 42376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Oct 30 04:08:20 host2 sshd[1964189]: Disconnected from invalid user pt 99.92.204.98 port 40284 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Oct 30 04:09:56 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<KB7Qz1NCrOynXpI3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-10-30 04:10:02 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:48892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-10-30 04:09:44 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:45438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 04:14:42 host2 sshd[1971311]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.92.204.98
country_id: 6252001
description:
Oct 30 04:14:58 host2 sshd[1971467]: Disconnected from invalid user extern 99.92.204.98 port 60326 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Oct 30 04:16:39 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TW3c51NC1OKUcdZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Oct 30 04:21:59 host2 sshd[1979905]: Disconnected from invalid user new 35.210.61.208 port 43092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Oct 30 04:22:03 host2 sshd[1980045]: Disconnected from invalid user testuser 157.245.49.180 port 46286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Oct 30 04:25:02 host2 sshd[1984047]: Disconnected from invalid user jnh 64.23.180.137 port 46278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:24:41 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Gf2JBFRCkNADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:25:58 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8zwhCVRCHI8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:27:58 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gH1UEFRCtLwDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.216.182
country_id: 6252001
description:
Oct 30 04:28:23 host2 sshd[1988620]: Disconnected from invalid user rasel 192.3.216.182 port 57900 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:29:21 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<nwE7FVRCDOQDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Oct 30 04:29:28 host2 sshd[1990118]: Disconnected from invalid user web10 35.210.61.208 port 46942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.216.182
country_id: 6252001
description:
Oct 30 04:30:23 host2 sshd[1991489]: Disconnected from invalid user openstack 192.3.216.182 port 47920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:30:36 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<gFG9GVRCnJ8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:33:00 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<OjFVIlRCKNgDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.216.182
country_id: 6252001
description:
Oct 30 04:32:23 host2 sshd[1994140]: Disconnected from invalid user liang 192.3.216.182 port 57268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:33:12 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iIMCI1RCMNgDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 04:33:22 host2 sshd[1995427]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.243.150.185
country_id: 2077456
description:
2025-10-30 04:34:17 dovecot_login authenticator failed for 123-243-150-185.static.tpgi.com.au [123.243.150.185]:48947: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.216.182
country_id: 6252001
description:
Oct 30 04:34:20 host2 sshd[1996847]: Disconnected from invalid user ci 192.3.216.182 port 35428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-10-30 04:34:35 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:54102: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:35:14 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7pJIKlRCxJYDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.20.92
country_id: 3895114
description:
2025-10-30 04:36:58 dovecot_login authenticator failed for ([45.238.20.92]) [45.238.20.92]:55848: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.11.128
country_id: 6252001
description:
2025-10-30 04:36:38 dovecot_login authenticator failed for 160-3-11-128.cpe.sparklight.net [160.3.11.128]:40634: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:36:39 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<PvBhL1RC4IYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 04:37:44 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<Jcg3M1RCvLoDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.49.180
country_id: 1880251
description:
Oct 30 04:40:47 host2 sshd[2004768]: Disconnected from invalid user test 157.245.49.180 port 38408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.175
country_id: 1733045
description:
2025-10-30 04:43:05 dovecot_login authenticator failed for ([49.124.154.175]) [49.124.154.175]:40464: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.191.235
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 165.22.191.235 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-10-30 04:43:24 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:42717: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2025-10-30 04:45:00 dovecot_login authenticator failed for ([49.124.155.174]) [49.124.155.174]:60896: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-10-30 04:45:17 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:40208: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-10-30 04:47:27 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:56633: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.143
country_id: 6252001
description:
Oct 30 04:49:27 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.143, lip=66.85.158.91, TLS: Connection closed, session=<QxgqXVRChK3HLZqP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.50.25.190
country_id: 1643084
description:
Oct 30 05:07:29 host2 sshd[2029502]: Disconnected from invalid user testftp 27.50.25.190 port 37794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.113.236
country_id: 1819730
description:
Oct 30 05:09:43 host2 sshd[2031356]: Disconnected from invalid user liuyang 154.219.113.236 port 32910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Oct 30 05:10:30 host2 sshd[2032268]: Disconnected from invalid user user5 27.50.25.190 port 55966 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 05:11:05 host2 sshd[2032932]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.54.246
country_id: 3865483
description:
2025-10-30 05:11:49 dovecot_login authenticator failed for ([170.83.54.246]) [170.83.54.246]:57231: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.113.236
country_id: 1819730
description:
Oct 30 05:12:15 host2 sshd[2033952]: Disconnected from invalid user webapp 154.219.113.236 port 46404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-10-30 05:12:36 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:43936: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-10-30 05:12:12 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:59048: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-10-30 05:14:16 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:57622: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.144
country_id: 1733045
description:
2025-10-30 05:14:46 dovecot_login authenticator failed for ([49.124.152.144]) [49.124.152.144]:58072: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
country_id: 290291
description:
2025-10-30 05:17:14 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:40315: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-10-30 05:20:26 dovecot_plain authenticator failed for (readaphary) [102.53.15.17]:59415: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-10-30 05:20:49 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:36712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.162
country_id: 1733045
description:
2025-10-30 05:21:17 dovecot_login authenticator failed for ([49.124.132.162]) [49.124.132.162]:54506: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.246
country_id: 6252001
description:
Oct 30 05:22:48 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.246, lip=66.85.158.92, TLS, session=<S3Nt1FRCbuXN0h/2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-10-30 05:22:52 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:37166: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.14
country_id: 1269750
description:
2025-10-30 05:23:06 dovecot_login authenticator failed for ([128.185.218.14]) [128.185.218.14]:53144: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.157
country_id: 953987
description:
Oct 30 05:25:58 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.129.55.157, lip=66.85.158.91, TLS, session=<BYha3lRCKrNmgTed>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-10-30 05:26:09 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:59974: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.114
country_id: 3469034
description:
Oct 30 05:26:25 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<training>, method=PLAIN, rip=190.89.137.114, lip=66.85.158.91, TLS, session=<Yvnz31RCepq+WYly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-10-30 05:26:36 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:45931: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.150
country_id: 2635167
description:
Oct 30 05:28:40 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.150, lip=66.85.158.92, TLS, session=<De5f6VRC25RX7LCW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Oct 30 05:28:41 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<GdJw6VRC0cRX7LBS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-10-30 05:29:14 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:41511: 535 Incorrect authentication data (set_id=euroentertainmentlk.com@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.77
country_id: 2635167
description:
Oct 30 05:29:14 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.77, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4lts61RCF+6594lN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-10-30 05:29:33 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:36448: 535 Incorrect authentication data (set_id=euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.86
country_id: 2635167
description:
Oct 30 05:29:47 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.86, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<aM5n7VRC461X7LBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Oct 30 05:30:21 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<j/ti71RCC8hX7LBR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.86
country_id: 2635167
description:
Oct 30 05:30:54 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.86, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QWpe8VRCDde594lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.77
country_id: 2635167
description:
Oct 30 05:31:27 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.77, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5dhX81RCvYtX7LBN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.107
country_id: 2635167
description:
Oct 30 05:32:00 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.107, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Xx5V9VRCWZdX7LBr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Oct 30 05:32:34 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.90, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<W0lQ91RCU8hX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Oct 30 05:33:07 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<6ahJ+VRC64q594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Oct 30 05:33:40 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<9wVF+1RCP6O594lM>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.107
country_id: 3017382
description:
Oct 30 05:42:40 host2 pure-ftpd[2062028]: (?@91.231.89.107) [INFO] New connection from 91.231.89.107


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 05:45:28 host2 sshd[2065565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-10-30 05:49:57 dovecot_login authenticator failed for ([125.22.20.25]) [128.185.192.166]:35302: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 05:50:15 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:46692: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-10-30 05:52:33 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54129: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-10-30 05:52:56 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:36816: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.248.47
country_id: 2921044
description:
Oct 30 05:55:00 host2 pure-ftpd[2075716]: (?@164.92.248.47) [INFO] New connection from 164.92.248.47


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 164.92.248.47
country_id: 2921044
description:
Oct 30 05:55:03 host2 pure-ftpd[2075922]: (?@164.92.248.47) [INFO] New connection from 164.92.248.47


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Oct 30 05:55:29 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<HpZISVVCWqGLonHU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.255.230
country_id: 2562770
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 130.185.255.230 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-10-30 05:58:44 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:51374: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-10-30 05:59:07 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:56576: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-10-30 06:00:38 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:42098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.88.209
country_id: 290557
description:
2025-10-30 06:01:06 dovecot_login authenticator failed for ([87.200.88.209]) [87.200.88.209]:60746: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-10-30 06:27:45 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:47428: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.75.89.78
country_id: 617790
description:
2025-10-30 06:30:45 dovecot_login authenticator failed for (host-static-37-75-89-78.moldtelecom.md) [37.75.89.78]:53691: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-10-30 06:31:08 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:39126: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-10-30 06:34:51 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:39550: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-10-30 06:35:15 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:40898: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2025-10-30 06:35:30 dovecot_login authenticator failed for ([49.125.201.70]) [49.125.201.70]:33336: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-10-30 06:37:21 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:48575: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-10-30 06:37:47 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:47072: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-10-30 06:39:23 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:51520: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-10-30 06:39:56 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:45490: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 06:41:41 host2 sshd[2117546]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 06:42:34 host2 sshd[2118242]: Disconnected from invalid user user 62.60.131.157 port 13582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.176
country_id: 2186224
description:
2025-10-30 06:42:59 dovecot_login authenticator failed for ([121.73.167.176]) [121.73.167.176]:47362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-10-30 06:43:13 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:55280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.77.197.111
country_id: 3617476
description:
Oct 30 06:52:57 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=186.77.197.111, lip=66.85.158.91, TLS, session=<gnWpFlZCTFG6TcVv>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.204
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.204: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-30 06:54:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54631: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Oct 30 06:55:19 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, TLS: Connection closed, session=<vZtBH1ZC7rBChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Oct 30 06:59:44 host2 sshd[2136043]: Disconnected from invalid user fts 52.224.109.126 port 56118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 07:02:55 host2 sshd[2140317]: Disconnected from invalid user user 2.57.121.25 port 54670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.109.126
country_id: 6252001
description:
Oct 30 07:03:09 host2 sshd[2140849]: Disconnected from invalid user usuario 52.224.109.126 port 54974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Oct 30 07:04:31 host2 sshd[2142685]: Disconnected from invalid user proradis 52.224.109.126 port 42266 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.249
country_id: 6252001
description:
Oct 30 07:04:26 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c4TcP1ZCkNDN0h/5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Oct 30 07:05:51 host2 sshd[2144405]: Disconnected from invalid user lili 52.224.109.126 port 36756 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.110.175.84
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.110.175.84 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-10-30 07:08:47 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:55714: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.254.134
country_id: 1269750
description:
2025-10-30 07:11:47 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.56.23.125.airtelbroadband.in) [125.20.254.134]:55544: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 07:14:04 host2 sshd[2153075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 07:16:05 host2 sshd[2155618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-10-30 07:18:36 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:48486: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.112.167
country_id: 1819730
description:
Oct 30 07:19:35 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.112.167, lip=66.85.158.91, TLS, session=<UW4OdlZCCmulmnCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-10-30 07:20:23 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [102.132.29.166]:54490: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-10-30 07:20:38 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:33770: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.33
country_id: 1605651
description:
Oct 30 07:23:41 host2 pure-ftpd[2163076]: (?@103.176.152.33) [INFO] New connection from 103.176.152.33


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.215
country_id: 6252001
description:
Oct 30 07:24:09 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.215, lip=66.85.158.92, session=<7j1bhlZCa5rDuEzX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Oct 30 07:23:56 host2 sshd[2163338]: Disconnected from invalid user bots 5.198.176.28 port 53368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-10-30 07:24:05 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:37736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-10-30 07:24:15 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:35897: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.142
country_id: 6252001
description:
Oct 30 07:24:19 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.142, lip=66.85.158.92, session=<FoT5hlZCad7DuEyO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Oct 30 07:25:16 host2 sshd[2164753]: Disconnected from invalid user pika 5.198.176.28 port 53480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-10-30 07:26:57 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:41080: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-10-30 07:27:51 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:41196: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.143
country_id: 6252001
description:
Oct 30 07:28:53 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.143, lip=66.85.158.92, session=<69RMl1ZCHY7DuEyP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.210
country_id: 6252001
description:
Oct 30 07:28:56 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.210, lip=66.85.158.92, session=<yLd8l1ZCi6/DuEzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.91
country_id: 6252001
description:
Oct 30 07:31:22 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.91, lip=66.85.158.91, TLS, session=<dbowoFZCpPbG6xhb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.40.96.12
country_id: 6251999
description:
Oct 30 07:33:21 host2 sshd[2172718]: Disconnected from invalid user janet 38.40.96.12 port 58950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Oct 30 07:37:15 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.182, lip=66.85.158.92, session=<cVs/tVZCGMNAPsW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.195
country_id: 6252001
description:
Oct 30 07:39:00 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.195, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iL17u1ZCtM/G6xjD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.130
country_id: 1269750
description:
2025-10-30 07:49:35 dovecot_login authenticator failed for ([182.95.22.104]) [125.23.155.130]:46816: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-10-30 07:50:29 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:58950: 535 Incorrect authentication data (set_id=maximsholdings@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-10-30 07:50:45 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:39524: 535 Incorrect authentication data (set_id=maximsholdings)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.212.55
country_id: 6251999
description:
Oct 30 07:55:43 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.212.55, lip=66.85.158.92, session=<VXtG91ZCgqyUcdQ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-30 07:55:43 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:37506: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.175.89.75
country_id: 6252001
description:
Oct 30 07:55:47 host2 sshd[2194305]: Disconnected from invalid user andrew 137.175.89.75 port 36034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.154
country_id: 3686110
description:
2025-10-30 07:55:57 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.148.187.154]:48501: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-10-30 07:58:01 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:55054: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.175.89.75
country_id: 6252001
description:
Oct 30 07:58:05 host2 sshd[2196189]: Disconnected from invalid user shares 137.175.89.75 port 57968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.240.244.53
country_id: 1269750
description:
2025-10-30 07:58:16 dovecot_login authenticator failed for ([152.52.93.82]) [115.240.244.53]:10400: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.202.191.93
country_id: 6252001
description:
[2025-10-30 08:00:30 +0530] info [webmaild] 142.202.191.93 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.97
country_id: 1819730
description:
Oct 30 08:00:32 host2 sshd[2198537]: Disconnected from invalid user shares 118.193.38.97 port 26696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-10-30 08:00:40 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:41799: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-10-30 08:01:10 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:60040: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Oct 30 08:02:10 host2 sshd[2199977]: Disconnected from invalid user chen 118.193.38.97 port 60348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.10.247
country_id: 2750405
description:
Oct 30 08:02:31 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=206.189.10.247, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<YHWSD1dCztbOvQr3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.180
country_id: 6252001
description:
Oct 30 08:09:28 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.180, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yGJ4KFdC99LG6xi0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 08:12:26 host2 sshd[2209513]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-10-30 08:13:29 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:32976: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-10-30 08:13:31 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:49844: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-10-30 08:13:43 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:60618: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 08:21:26 host2 sshd[2217778]: Disconnected from invalid user user 62.60.131.157 port 30327 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.36
country_id: 6252001
description:
Oct 30 08:22:13 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.36, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6Y4PVldCi9yTuYQk>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:23:14 host2 pure-ftpd[2219573]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:22:17 host2 pure-ftpd[2218726]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:23:15 host2 pure-ftpd[2219635]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:23:21 host2 pure-ftpd[2219707]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-10-30 08:24:55 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:39179: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:24:17 host2 pure-ftpd[2220595]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:24:21 host2 pure-ftpd[2220716]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:25:17 host2 pure-ftpd[2221793]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.102
country_id: 1269750
description:
2025-10-30 08:25:20 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.102]:38096: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:25:20 host2 pure-ftpd[2221840]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:26:17 host2 pure-ftpd[2222789]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:26:20 host2 pure-ftpd[2222815]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:27:16 host2 pure-ftpd[2223669]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:27:20 host2 pure-ftpd[2223712]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2025-10-30 08:27:51 dovecot_login authenticator failed for ([49.124.151.53]) [49.124.151.53]:53710: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:28:17 host2 pure-ftpd[2224989]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:28:19 host2 pure-ftpd[2225053]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-10-30 08:28:28 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:49872: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:29:19 host2 pure-ftpd[2226126]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:29:17 host2 pure-ftpd[2226110]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:30:19 host2 pure-ftpd[2227455]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:30:17 host2 pure-ftpd[2227391]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:31:17 host2 pure-ftpd[2228342]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:31:19 host2 pure-ftpd[2228378]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:32:17 host2 pure-ftpd[2229394]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:32:18 host2 pure-ftpd[2229398]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:33:15 host2 pure-ftpd[2230318]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:33:18 host2 pure-ftpd[2230363]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Oct 30 08:33:32 host2 pure-ftpd[2230619]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.145.159.15
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 132.145.159.15 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-10-30 08:33:48 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:42322: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:34:17 host2 pure-ftpd[2231509]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:34:18 host2 pure-ftpd[2231544]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:35:16 host2 pure-ftpd[2232678]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:35:17 host2 pure-ftpd[2232722]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.23
country_id: 1733045
description:
2025-10-30 08:35:48 dovecot_login authenticator failed for ([49.124.153.23]) [49.124.153.23]:36020: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-10-30 08:36:14 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:46978: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:36:16 host2 pure-ftpd[2233626]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:36:17 host2 pure-ftpd[2233661]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:37:17 host2 pure-ftpd[2234636]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.174.52.162
country_id: 1269750
description:
Oct 30 08:37:16 host2 pure-ftpd[2234615]: (?@103.174.52.162) [INFO] New connection from 103.174.52.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Oct 30 08:37:45 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<k3CVjVdCwr9ChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-10-30 08:38:46 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:49280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-10-30 08:38:50 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:51373: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-10-30 08:39:09 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:34090: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-10-30 08:38:29 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:54138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Oct 30 08:39:35 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<P6ErlFdChs1HBobp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-10-30 08:41:23 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:48250: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-10-30 08:41:41 dovecot_login authenticator failed for (nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:49468: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Oct 30 08:44:46 host2 sshd[2242003]: Disconnected from invalid user cloud 146.59.95.254 port 46500 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 08:46:51 host2 sshd[2245122]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.239.184
country_id: 1643084
description:
Oct 30 08:48:48 host2 sshd[2246749]: Disconnected from invalid user usuario 103.49.239.184 port 55732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Oct 30 08:52:05 host2 sshd[2249718]: Disconnected from invalid user ddos 103.49.239.184 port 41800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.195.206
country_id: 6252001
description:
Oct 30 08:51:53 host2 sshd[2249596]: Invalid user secondcoffeeinternational from 50.6.195.206 port 38872


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Oct 30 08:52:22 host2 sshd[2249971]: Disconnected from invalid user zara 45.120.216.232 port 58388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Oct 30 08:54:19 host2 sshd[2251799]: Disconnected from invalid user ddos 146.59.95.254 port 41650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-10-30 09:02:33 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:60891: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.24
country_id: 1733045
description:
2025-10-30 09:03:00 dovecot_login authenticator failed for ([49.124.151.24]) [49.124.151.24]:42228: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Oct 30 09:03:41 host2 pure-ftpd[2261531]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-10-30 09:05:23 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:34252: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.146
country_id: 1733045
description:
2025-10-30 09:05:48 dovecot_login authenticator failed for ([49.124.152.146]) [49.124.152.146]:51698: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.202.191.93
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 142.202.191.93 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 09:10:35 host2 sshd[2267651]: Disconnected from invalid user user 2.57.121.25 port 26005 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.125.110
country_id: 1819730
description:
Oct 30 09:12:12 host2 sshd[2269225]: Disconnected from invalid user oracle 223.197.125.110 port 45866 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Oct 30 09:11:37 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<JBy0BlhCFhSs7OT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-10-30 09:13:50 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:40134: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.31
country_id: 1733045
description:
2025-10-30 09:14:15 dovecot_login authenticator failed for ([49.124.148.31]) [49.124.148.31]:56324: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.125.110
country_id: 1819730
description:
Oct 30 09:14:55 host2 sshd[2271860]: Disconnected from invalid user oracle 223.197.125.110 port 38398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-10-30 09:15:53 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:45778: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-30 09:15:54 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53034: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-10-30 09:16:08 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:34641: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
country_id: 290291
description:
2025-10-30 09:16:18 dovecot_login authenticator failed for ([81.22.19.176]) [81.22.19.176]:35147: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-10-30 09:16:30 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:47057: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-10-30 09:16:46 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:46386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-10-30 09:16:19 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:59023: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.111.4
country_id: 2510769
description:
2025-10-30 09:17:21 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:35006: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Oct 30 09:18:28 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<INU7H1hC3qtChJl4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.125.110
country_id: 1819730
description:
Oct 30 09:20:16 host2 sshd[2276941]: Disconnected from invalid user hafiz 223.197.125.110 port 46614 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.223.177.175
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 111.223.177.175 - nccphealthgov "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Oct 30 09:29:48 host2 sshd[2286664]: Disconnected from invalid user vipin 103.38.182.49 port 47974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Oct 30 09:31:34 host2 sshd[2288497]: Disconnected from invalid user app 103.38.182.49 port 47914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.38.182.49
country_id: 1269750
description:
Oct 30 09:33:15 host2 sshd[2290084]: Disconnected from invalid user test 103.38.182.49 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Oct 30 09:36:34 host2 sshd[2293599]: Disconnected from invalid user sl 103.38.182.49 port 34786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Oct 30 09:40:02 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.48, lip=66.85.158.91, TLS: Connection closed, session=<r1JWbFhCboynXpIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-10-30 09:40:44 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:59812: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-10-30 09:41:09 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58407: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Oct 30 09:40:16 host2 sshd[2297605]: Disconnected from invalid user jean 139.59.188.13 port 52548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.51.135.38
country_id: 3469034
description:
Oct 30 09:41:16 host2 sshd[2298571]: Disconnected from invalid user ubuntu 38.51.135.38 port 37136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-10-30 09:43:38 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:29852: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-10-30 09:43:55 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:46868: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Oct 30 09:44:20 host2 sshd[2301580]: Disconnected from invalid user oracle 139.59.188.13 port 45844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Oct 30 09:45:49 host2 sshd[2303476]: Disconnected from invalid user admin 85.185.120.213 port 56758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.51.135.38
country_id: 3469034
description:
Oct 30 09:45:58 host2 sshd[2303540]: Disconnected from invalid user jairo 38.51.135.38 port 53424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.185.120.213
country_id: 130758
description:
Oct 30 09:47:13 host2 sshd[2304809]: Disconnected from invalid user cib 85.185.120.213 port 50202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:49:16 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NHVWjVhCstADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.146.226
country_id: 2017370
description:
2025-10-30 09:50:15 dovecot_login authenticator failed for (91.200.146-226.in-addr.netone.ru) [91.200.146.226]:60568: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.51.135.38
country_id: 3469034
description:
Oct 30 09:51:14 host2 sshd[2308816]: Disconnected from invalid user aman 38.51.135.38 port 53640 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:51:17 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<a0+UlFhCVO0Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2025-10-30 09:51:50 dovecot_login authenticator failed for ([49.124.151.78]) [49.124.151.78]:52108: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-10-30 09:52:27 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:45102: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:53:50 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<8hG3nVhCnNsDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-30 09:55:00 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:37904: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:55:01 host2 dovecot[1612370]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<lSnwoVhC2sADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:55:34 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<va/lo1hC+MIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:56:17 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<aXxvplhCltkDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.51.135.38
country_id: 3469034
description:
Oct 30 09:56:32 host2 sshd[2314858]: Disconnected from invalid user test2 38.51.135.38 port 48982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:57:38 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<mJtJq1hCgK4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-10-30 09:57:45 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:28113: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-10-30 09:56:56 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:46080: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 30 09:57:07 host2 dovecot[1612370]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<wkVyqVhCOK0Dg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.51.135.38
country_id: 3469034
description:
Oct 30 09:59:11 host2 sshd[2317221]: Disconnected from invalid user dev 38.51.135.38 port 56040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2025-10-30 10:00:06 dovecot_login authenticator failed for ([49.124.153.15]) [49.124.153.15]:50656: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.157
country_id: 6252001
description:
Oct 30 10:01:58 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=66.228.53.157, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Q0zJulhCZshC5DWd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.18
country_id: 2635167
description:
Oct 30 10:06:10 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.18, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AjTPyVhClMojy9IS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.89.124.223
country_id: 6252001
description:
Oct 30 10:06:15 host2 pure-ftpd[2324150]: (?@13.89.124.223) [INFO] New connection from 13.89.124.223


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.102.92.213
country_id: 6252001
description:
Oct 30 10:06:27 host2 pure-ftpd[2324298]: (?@20.102.92.213) [INFO] New connection from 20.102.92.213


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.12.122
country_id: 6252001
description:
Oct 30 10:07:27 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.33.12.122, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<U0hdzlhCNuAtIQx6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.163.34
country_id: 1643084
description:
Oct 30 10:08:22 host2 sshd[2326053]: Disconnected from invalid user admin 36.88.163.34 port 57522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.18
country_id: 2635167
description:
Oct 30 10:12:05 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.18, lip=66.85.158.92, TLS, session=<GrL03lhCqvkjy9IS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Oct 30 10:13:32 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<AOsk5FhCNiDUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-10-30 10:19:30 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:42590: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.88.163.34
country_id: 1643084
description:
Oct 30 10:20:03 host2 sshd[2337351]: Disconnected from invalid user proman 36.88.163.34 port 37792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-10-30 10:19:51 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:55975: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-10-30 10:21:44 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:55672: 535 Incorrect authentication data (set_id=euroentertainmentlk@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.163.34
country_id: 1643084
description:
Oct 30 10:21:22 host2 sshd[2339289]: Disconnected from invalid user team 36.88.163.34 port 57690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-10-30 10:21:38 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:39715: 535 Incorrect authentication data (set_id=euroentertainmentlk@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-10-30 10:22:22 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59466: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Oct 30 10:22:22 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, TLS, session=<IXnAA1lC5qktT4DN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2025-10-30 10:22:01 dovecot_login authenticator failed for ([49.124.152.222]) [49.124.152.222]:44468: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.190
country_id: 1733045
description:
2025-10-30 10:28:16 dovecot_login authenticator failed for ([49.124.159.190]) [49.124.159.190]:46814: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-10-30 10:28:39 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:60809: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Oct 30 10:28:04 host2 sshd[2346489]: Disconnected from invalid user meliana 118.194.231.208 port 58748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.37.218.60
country_id: 2077456
description:
Oct 30 10:29:50 host2 sshd[2348230]: Disconnected from invalid user new 20.37.218.60 port 39906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.121.205
country_id: 294640
description:
2025-10-30 10:30:07 dovecot_login authenticator failed for ([46.210.121.205]) [46.210.121.205]:33363: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-10-30 10:30:21 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:45572: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.37.218.60
country_id: 2077456
description:
Oct 30 10:31:25 host2 sshd[2350085]: Disconnected from invalid user usuario 20.37.218.60 port 47344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-10-30 10:33:46 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:51858: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Oct 30 10:32:51 host2 sshd[2351503]: Disconnected from invalid user usuario 118.194.231.208 port 59022 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.37.218.60
country_id: 2077456
description:
Oct 30 10:33:04 host2 sshd[2351849]: Disconnected from invalid user temp 20.37.218.60 port 57762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.67.124.224
country_id: 2077456
description:
2025-10-30 10:33:28 dovecot_login authenticator failed for (224.124.67.202.static.nbn.dodo.com.au) [202.67.124.224]:54211: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Oct 30 10:34:18 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0xVpLllCp8qTuYTn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Oct 30 10:35:51 host2 sshd[2354820]: Disconnected from invalid user xufeng 118.194.231.208 port 59206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.37.218.60
country_id: 2077456
description:
Oct 30 10:37:58 host2 sshd[2356807]: Disconnected from invalid user user 20.37.218.60 port 46334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Oct 30 10:38:36 host2 sshd[2357340]: Disconnected from invalid user yxx 118.194.231.208 port 59384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-30 10:40:34 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53105: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Oct 30 10:46:58 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.238, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+A64W1lCEtXG6xju>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 10:48:20 host2 sshd[2367497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 10:51:15 host2 sshd[2370379]: Disconnected from invalid user user 2.57.121.25 port 36681 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 10:54:52 host2 sshd[2374368]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-10-30 10:59:31 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:35480: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-10-30 11:00:25 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:42186: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-10-30 11:02:17 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:58178: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.83.133
country_id: 241170
description:
Oct 30 11:02:33 host2 pure-ftpd[2382664]: (?@196.251.83.133) [INFO] New connection from 196.251.83.133


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.138
country_id: 2750405
description:
Oct 30 11:02:32 host2 pure-ftpd[2382655]: (?@196.251.87.138) [INFO] New connection from 196.251.87.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.4
country_id: 2635167
description:
Oct 30 11:02:54 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.4, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+FCzlFlCrsgjy9IE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 11:02:57 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:45347: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-30 11:03:24 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:49577: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.4
country_id: 2635167
description:
Oct 30 11:03:50 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.210.4, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<0ngFmFlCOOYjy9IE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-10-30 11:09:15 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:35738: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.4
country_id: 2635167
description:
Oct 30 11:09:43 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.4, lip=66.85.158.91, TLS, session=<2DsPrVlCQuMjy9IE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-10-30 11:09:55 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:54374: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.4
country_id: 2635167
description:
Oct 30 11:10:37 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.4, lip=66.85.158.91, TLS, session=<wH1DsFlC0uIjy9IE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-10-30 11:11:47 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:38934: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.112.16.117
country_id: 1861060
description:
2025-10-30 11:12:26 dovecot_login authenticator failed for 117.16.112.219.ap.yournet.ne.jp [219.112.16.117]:49033: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-10-30 11:14:35 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:60812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.40.121.4
country_id: 1643084
description:
2025-10-30 11:14:47 dovecot_login authenticator failed for (ip-4.121.40.jogjaringan.net.id) [103.40.121.4]:50369: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.153
country_id: 6252001
description:
Oct 30 11:18:08 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.153, lip=66.85.158.91, session=<ZHgwy1lCRvSTuYSZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Oct 30 11:18:42 host2 sshd[2403431]: Disconnected from invalid user yahia 178.128.243.225 port 37346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Oct 30 11:22:08 host2 sshd[2406576]: Disconnected from invalid user csgoserver 178.128.243.225 port 58128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.26.159.53
country_id: 2077456
description:
Oct 30 11:26:13 host2 sshd[2410376]: Disconnected from invalid user ashwood 154.26.159.53 port 45692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Oct 30 11:27:06 host2 sshd[2411238]: Disconnected from invalid user gestion 178.128.243.225 port 47146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Oct 30 11:27:13 host2 sshd[2411266]: Disconnected from invalid user VPN 103.188.177.46 port 38596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Oct 30 11:28:16 host2 sshd[2412257]: Disconnected from invalid user deploy 178.128.243.225 port 39222 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.243.225
country_id: 2750405
description:
Oct 30 11:29:29 host2 sshd[2413230]: Disconnected from invalid user sct 178.128.243.225 port 52892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.26.159.53
country_id: 2077456
description:
Oct 30 11:29:41 host2 sshd[2413381]: Disconnected from invalid user arif 154.26.159.53 port 42212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-10-30 11:28:54 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:35016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-10-30 11:29:11 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:43100: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Oct 30 11:32:57 host2 sshd[2416252]: Disconnected from invalid user username 103.188.177.46 port 52620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.188.177.46
country_id: 1643084
description:
Oct 30 11:34:28 host2 sshd[2417603]: Disconnected from invalid user elastic 103.188.177.46 port 42002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 11:34:58 host2 sshd[2417973]: Disconnected from invalid user user 62.60.131.157 port 54931 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-10-30 11:38:44 dovecot_login authenticator failed for ([1.7.83.133]) [1.7.83.133]:24898: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.248
country_id: 1733045
description:
2025-10-30 11:39:15 dovecot_login authenticator failed for ([49.124.150.248]) [49.124.150.248]:49994: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.182
country_id: 6252001
description:
Oct 30 11:38:54 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.182, lip=66.85.158.91, TLS, session=<rZZxFVpCeP7G6xi2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2025-10-30 11:41:34 dovecot_login authenticator failed for ([49.124.153.42]) [49.124.153.42]:56122: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2025-10-30 11:41:56 dovecot_login authenticator failed for ([49.124.150.251]) [49.124.150.251]:36692: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.171.123.49
country_id: 6252001
description:
2025-10-30 11:46:14 dovecot_plain authenticator failed for ([104.171.123.49]) [104.171.123.49]:53359: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
country_id: 1269750
description:
2025-10-30 11:48:04 dovecot_login authenticator failed for ([118.91.176.243]) [118.91.176.243]:33537: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-10-30 11:48:20 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41492: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.87.210
country_id: 2921044
description:
Oct 30 11:49:12 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.122.87.210, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<RiBMOlpC5yaGelfS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.36
country_id: 1819730
description:
Oct 30 11:49:44 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.36, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ycswPFpC5r8tjpok>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.248.47
country_id: 2921044
description:
Oct 30 11:49:48 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.92.248.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<edtlPFpChD6kXPgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-10-30 11:49:54 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:42342: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-10-30 11:50:08 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:38894: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-10-30 11:52:51 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:51301: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-10-30 11:53:11 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:51278: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 12:12:13 host2 sshd[2453321]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.194.85
country_id: 1880251
description:
Oct 30 12:15:37 host2 sshd[2456614]: Disconnected from invalid user ansadmin 45.78.194.85 port 36930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-10-30 12:17:02 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:47050: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-10-30 12:17:45 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:54316: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-10-30 12:19:29 dovecot_login authenticator failed for (173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:59292: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.47.133.240
country_id: 2510769
description:
2025-10-30 12:20:29 dovecot_login authenticator failed for 240.red-83-47-133.dynamicip.rima-tde.net [83.47.133.240]:44345: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 12:25:07 host2 sshd[2465281]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.13.59
country_id: 6252001
description:
Oct 30 12:24:59 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.13.59, lip=66.85.158.91, session=<nm9CulpCvI4v+w07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-10-30 12:26:14 dovecot_login authenticator failed for (static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:55674: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-10-30 12:26:35 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:35690: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-10-30 12:28:55 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:45800: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 12:31:38 host2 sshd[2470777]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-10-30 12:30:58 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:60858: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-10-30 12:31:13 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:11046: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-10-30 12:52:57 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:36913: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-10-30 12:53:07 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:41824: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-10-30 12:54:59 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:50965: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-10-30 12:55:16 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:34388: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
country_id: 99237
description:
2025-10-30 12:57:44 dovecot_login authenticator failed for ([65.20.204.164]) [65.20.204.164]:42830: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-10-30 12:58:21 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:58664: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.140.176.124
country_id: 2510769
description:
Oct 30 12:59:21 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=89.140.176.124, lip=66.85.158.91, TLS, session=<7PEHNFtCXYBZjLB8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-10-30 12:59:26 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:34484: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-10-30 12:59:39 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:38134: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.42
country_id: 690791
description:
Oct 30 12:59:44 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=37.221.131.42, lip=66.85.158.91, TLS, session=<lLZVNVtC/6El3YMq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-10-30 13:04:02 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:43346: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-10-30 13:04:17 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:40214: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-10-30 13:06:11 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:46105: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-10-30 13:06:24 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:57729: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-10-30 13:09:23 dovecot_login authenticator failed for ([122.186.202.54]) [122.186.202.54]:58324: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-10-30 13:09:57 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:58054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.134.45
country_id: 1819730
description:
Oct 30 13:12:05 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=152.32.134.45, lip=66.85.158.91, session=<xH6uYltCDuiYIIYt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.161.232
country_id: 1269750
description:
Oct 30 13:15:59 host2 sshd[2511669]: Disconnected from invalid user comptan 182.18.161.232 port 41218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.161.232
country_id: 1269750
description:
Oct 30 13:17:26 host2 sshd[2513014]: Disconnected from invalid user ruibao 182.18.161.232 port 44260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.161.232
country_id: 1269750
description:
Oct 30 13:18:51 host2 sshd[2514160]: Disconnected from invalid user chensiyu 182.18.161.232 port 47296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.161.232
country_id: 1269750
description:
Oct 30 13:20:10 host2 sshd[2515341]: Disconnected from invalid user cacace 182.18.161.232 port 50338 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Oct 30 13:30:36 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, session=<vPzspFtCELOUcdZj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Oct 30 13:31:07 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2V/IpltCrIqUcd3D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-10-30 13:33:16 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:48846: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2025-10-30 13:33:50 dovecot_login authenticator failed for ([182.79.86.54]) [182.79.86.54]:59070: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-10-30 13:36:09 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:42338: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-10-30 13:36:23 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54814: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.89.84.223
country_id: 2328926
description:
2025-10-30 13:37:35 dovecot_plain authenticator failed for ([192.168.0.158]) [102.89.84.223]:7810: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.89.84.223
country_id: 2328926
description:
2025-10-30 13:37:41 dovecot_login authenticator failed for ([192.168.0.158]) [102.89.84.223]:7810: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.94
country_id: 1269750
description:
2025-10-30 13:42:45 dovecot_login authenticator failed for ([128.185.223.214]) [27.123.111.94]:50212: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-10-30 13:43:05 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:54023: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-10-30 13:44:26 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:52010: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2025-10-30 13:44:54 dovecot_login authenticator failed for ([49.125.201.69]) [49.125.201.69]:50690: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.129.52
country_id: 1210997
description:
Oct 30 13:45:30 host2 sshd[2537698]: Disconnected from invalid user vision 103.51.129.52 port 34890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-10-30 13:47:12 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:33154: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-10-30 13:47:46 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:51368: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.51.129.52
country_id: 1210997
description:
Oct 30 13:50:09 host2 sshd[2541841]: Disconnected from invalid user rdp 103.51.129.52 port 58180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.129.52
country_id: 1210997
description:
Oct 30 13:57:58 host2 sshd[2550236]: Disconnected from invalid user zookeeper 103.51.129.52 port 54346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.132.217
country_id: 1733045
description:
Oct 30 13:58:05 host2 sshd[2550387]: Disconnected from invalid user yoga 103.159.132.217 port 58494 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 14:01:36 host2 sshd[2553562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.111
country_id: 1880251
description:
Oct 30 14:02:39 host2 sshd[2554457]: Disconnected from invalid user shaw 101.47.142.111 port 51438 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 14:08:06 host2 sshd[2559644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.111
country_id: 1880251
description:
Oct 30 14:08:11 host2 sshd[2559701]: Disconnected from invalid user tamiso 101.47.142.111 port 43396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.82.128.4
country_id: 1605651
description:
Oct 30 14:10:10 host2 sshd[2561653]: Disconnected from invalid user rafiq 58.82.128.4 port 35074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.6.100.191
country_id: 3469034
description:
Oct 30 14:10:42 host2 sshd[2562077]: Disconnected from invalid user mohamed 201.6.100.191 port 60770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-10-30 14:11:37 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:41160: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.81.150
country_id: 1269750
description:
2025-10-30 14:12:00 dovecot_login authenticator failed for ([103.181.81.150]) [103.181.81.150]:58803: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.132
country_id: 1643084
description:
Oct 30 14:13:10 host2 sshd[2564452]: Disconnected from invalid user rajesh 103.67.78.132 port 40404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-10-30 14:15:21 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:59869: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-10-30 14:14:39 dovecot_login authenticator failed for ([128.185.217.149]) [125.19.156.2]:43348: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Oct 30 14:14:45 host2 sshd[2565683]: Disconnected from invalid user lily 103.67.78.132 port 53344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Oct 30 14:16:24 host2 sshd[2567265]: Disconnected from invalid user gitea 103.67.78.132 port 37450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.82.128.4
country_id: 1605651
description:
Oct 30 14:16:44 host2 sshd[2567539]: Disconnected from invalid user admin 58.82.128.4 port 22354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.82.128.4
country_id: 1605651
description:
Oct 30 14:18:14 host2 sshd[2568785]: Disconnected from invalid user hulk 58.82.128.4 port 15112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.217
country_id: 1733045
description:
Oct 30 14:17:45 host2 sshd[2568390]: Disconnected from invalid user carmine 103.159.132.217 port 35956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Oct 30 14:18:48 host2 sshd[2569321]: Disconnected from invalid user ares 143.198.85.84 port 45426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-10-30 14:20:32 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:56760: 535 Incorrect authentication data (set_id=editor@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 14:20:35 host2 sshd[2570845]: Disconnected from invalid user user 62.60.131.157 port 64207 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Oct 30 14:20:36 host2 sshd[2570854]: Disconnected from invalid user dale 143.198.85.84 port 53394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2025-10-30 14:21:02 dovecot_login authenticator failed for (telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:56477: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Oct 30 14:22:23 host2 sshd[2572362]: Disconnected from invalid user kiara 143.198.85.84 port 54956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.179
country_id: 3469034
description:
2025-10-30 14:22:45 dovecot_login authenticator failed for ([186.227.91.179]) [186.227.91.179]:35936: 535 Incorrect authentication data (set_id=editor@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-10-30 14:23:06 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:59002: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Oct 30 14:24:06 host2 sshd[2573766]: Disconnected from invalid user imaps 103.159.199.42 port 57278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-10-30 14:25:30 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:37141: 535 Incorrect authentication data (set_id=editor@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-10-30 14:25:42 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:39212: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.92.60
country_id: 2750405
description:
Oct 30 14:25:48 host2 sshd[2575253]: Invalid user cloudtourssrilan_travel from 196.251.92.60 port 41170


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.92.60
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.251.92.60 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.39.48.166
country_id: 130758
description:
Oct 30 14:27:03 host2 sshd[2576202]: Disconnected from invalid user diogo 78.39.48.166 port 15072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Oct 30 14:27:17 host2 sshd[2576349]: Disconnected from invalid user lf 103.159.199.42 port 44600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.39.48.166
country_id: 130758
description:
Oct 30 14:29:35 host2 sshd[2578427]: Disconnected from invalid user angelina 78.39.48.166 port 32459 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.199.42
country_id: 1643084
description:
Oct 30 14:30:10 host2 sshd[2579109]: Disconnected from invalid user paolocci 103.159.199.42 port 49266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.179.197
country_id: 3017382
description:
Oct 30 14:31:29 host2 sshd[2580112]: Disconnected from invalid user zhouxuan 51.210.179.197 port 41334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-10-30 14:31:45 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:33962: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-30 14:32:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58202: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-10-30 14:32:02 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40934: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-10-30 14:34:07 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:48072: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Oct 30 14:34:12 host2 sshd[2582523]: Disconnected from invalid user liyong 143.198.85.84 port 40356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.255.145.253
country_id: 6252001
description:
2025-10-30 14:34:46 dovecot_login authenticator failed for (50-255-145-253-static.hfc.comcastbusiness.net) [50.255.145.253]:45432: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.92.60
country_id: 2750405
description:
Oct 30 14:42:43 host2 sshd[2589794]: Invalid user cloudtourssrilan_travel from 196.251.92.60 port 36904


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-30 14:50:23 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:39693: 535 Incorrect authentication data (set_id=editor@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.237
country_id: 1733045
description:
2025-10-30 14:51:01 dovecot_login authenticator failed for ([49.124.152.237]) [49.124.152.237]:52538: 535 Incorrect authentication data (set_id=editor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
country_id: 1269750
description:
2025-10-30 14:53:06 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:59482: 535 Incorrect authentication data (set_id=editor@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-10-30 15:02:06 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:56060: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-10-30 15:02:46 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:57218: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-10-30 15:05:14 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:4181: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-10-30 15:05:34 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:37199: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.159.130
country_id: 1643084
description:
Oct 30 15:04:43 host2 sshd[2612656]: Disconnected from invalid user yth 182.253.159.130 port 43254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.159.130
country_id: 1643084
description:
Oct 30 15:10:34 host2 sshd[2618328]: Disconnected from invalid user saurav 182.253.159.130 port 33728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.73.160.186
country_id: 6252001
description:
2025-10-30 15:12:32 dovecot_plain authenticator failed for ([100.64.100.6]) [216.73.160.186]:8709: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.73.160.186
country_id: 6252001
description:
2025-10-30 15:12:46 dovecot_plain authenticator failed for ([100.64.100.6]) [216.73.160.186]:24752: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.159.130
country_id: 1643084
description:
Oct 30 15:13:42 host2 sshd[2621634]: Disconnected from invalid user fsf 182.253.159.130 port 43862 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.230.103
country_id: 2921044
description:
Oct 30 15:15:23 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.92.230.103, lip=66.85.158.91, session=<QwShG11C2ZakXOZn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.189.98
country_id: 2921044
description:
Oct 30 15:15:24 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.189.98, lip=66.85.158.91, session=<9L2xG11CuIeKxb1i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-10-30 15:16:14 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:37691: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-10-30 15:16:17 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:59328: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-10-30 15:16:27 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:48065: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-10-30 15:16:49 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:52777: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Oct 30 15:27:39 host2 sshd[2635083]: Disconnected from invalid user sandi 69.74.29.21 port 29793 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Oct 30 15:30:16 host2 sshd[2637775]: Disconnected from invalid user kanazawa 69.74.29.21 port 37700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-10-30 15:30:38 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:58814: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-10-30 15:30:55 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:53820: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.163
country_id: 2635167
description:
Oct 30 15:31:12 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.163, lip=66.85.158.92, session=<ULI0VF1CxOwjy9Kj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.45.144
country_id: 6251999
description:
2025-10-30 15:33:06 dovecot_login authenticator failed for dhcp-b8-94-70-ce-5f-fc.cpe.i-zoom.net [24.137.45.144]:44547: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.140.231
country_id: 1168579
description:
2025-10-30 15:33:53 dovecot_login authenticator failed for ([103.139.140.231]) [103.139.140.231]:54641: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.40
country_id: 6252001
description:
Oct 30 15:35:27 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.40, lip=66.85.158.92, session=<qhdnY11CHP7G6xgo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.93
country_id: 2635167
description:
Oct 30 15:37:04 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS, session=<UXMtaV1CneC594ld>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 15:37:58 host2 sshd[2646497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.20.92
country_id: 3895114
description:
2025-10-30 15:39:25 dovecot_login authenticator failed for ([45.238.20.92]) [45.238.20.92]:43167: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-10-30 15:40:01 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:52874: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-10-30 15:41:27 dovecot_plain authenticator failed for (clize) [46.8.240.26]:39858: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-10-30 15:41:53 dovecot_login authenticator failed for ([136.228.168.12]) [136.228.168.12]:58846: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-10-30 15:42:08 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:42356: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.228.11.195
country_id: 6252001
description:
2025-10-30 15:43:15 dovecot_plain authenticator failed for c-71-228-11-195.hsd1.il.comcast.net (sceprect) [71.228.11.195]:42212: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 15:44:27 host2 sshd[2653931]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.59
country_id: 1269750
description:
2025-10-30 15:44:19 dovecot_login authenticator failed for (nsg-corporate-59.234.187.122.airtel.in) [122.187.234.59]:56482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-10-30 15:44:14 dovecot_plain authenticator failed for (ovedidako) [65.20.250.63]:42257: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.81.244.142
country_id: 1269750
description:
Oct 30 15:45:15 host2 sshd[2654967]: Disconnected from invalid user backupuser 40.81.244.142 port 50518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.162
country_id: 130758
description:
Oct 30 15:45:57 host2 sshd[2655930]: Disconnected from invalid user lfs 185.213.164.162 port 44266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.162
country_id: 130758
description:
Oct 30 15:47:12 host2 sshd[2657446]: Disconnected from invalid user rancid 185.213.164.162 port 49374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Oct 30 15:47:37 host2 sshd[2657856]: Disconnected from invalid user az 103.250.10.21 port 42370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.94.72
country_id: 6252001
description:
Oct 30 15:46:44 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.94.72, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XiPKi11C3uAUDl5I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 15:46:50 host2 sshd[2656971]: Disconnected from invalid user user 2.57.121.25 port 17088 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.164.162
country_id: 130758
description:
Oct 30 15:48:23 host2 sshd[2658733]: Disconnected from invalid user jules 185.213.164.162 port 34768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.21
country_id: 1643084
description:
Oct 30 15:50:29 host2 sshd[2661272]: Disconnected from invalid user sebastian 103.250.10.21 port 44628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.233.119
country_id: 2661886
description:
2025-10-30 15:50:45 dovecot_plain authenticator failed for c188-150-233-119.bredband.tele2.se (sycouster) [188.150.233.119]:57006: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-30 15:52:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ververes) [87.103.126.54]:36779: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 15:53:39 host2 sshd[2664666]: Disconnected from invalid user user 62.60.131.157 port 51991 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.36.71
country_id: 6252001
description:
Oct 30 15:56:57 host2 sshd[2668967]: Disconnected from invalid user mcc 165.154.36.71 port 38492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-10-30 15:57:00 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (pouppocid) [217.215.74.195]:35904: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Oct 30 15:57:30 host2 sshd[2669464]: Disconnected from invalid user dema 152.32.213.170 port 51734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.36.71
country_id: 6252001
description:
Oct 30 15:57:59 host2 sshd[2669991]: Disconnected from invalid user arma3server 165.154.36.71 port 61692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-10-30 15:58:29 dovecot_plain authenticator failed for (macedownes) [87.200.226.113]:49023: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Oct 30 15:58:36 host2 sshd[2670520]: Disconnected from invalid user admin 125.20.16.22 port 17860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Oct 30 16:00:16 host2 sshd[2672342]: Disconnected from invalid user client 125.20.16.22 port 9374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Oct 30 16:00:22 host2 sshd[2672447]: Disconnected from invalid user michael 152.32.213.170 port 57866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-10-30 16:01:21 dovecot_plain authenticator failed for (nonve) [65.20.133.4]:39282: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.36.71
country_id: 6252001
description:
Oct 30 16:01:48 host2 sshd[2673558]: Disconnected from invalid user ftpuser 165.154.36.71 port 44510 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Oct 30 16:01:51 host2 sshd[2673575]: Disconnected from invalid user mx 125.20.16.22 port 47092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Oct 30 16:04:59 host2 sshd[2677318]: Disconnected from invalid user jpalacios 125.20.16.22 port 38780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-10-30 16:04:35 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (chrea) [24.23.125.83]:36130: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.183.177
country_id: 6252001
description:
Oct 30 16:07:11 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.183.177, lip=66.85.158.92, TLS, session=<jM7h1F1CXJ4ofLex>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-10-30 16:08:05 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (gasses) [68.46.148.180]:37890: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.111.4
country_id: 2510769
description:
2025-10-30 16:09:18 dovecot_login authenticator failed for 4.red-79-154-111.dynamicip.rima-tde.net [79.154.111.4]:47562: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-10-30 16:09:29 dovecot_plain authenticator failed for (rigarya) [65.20.153.146]:55486: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-10-30 16:11:20 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:35000: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-10-30 16:15:25 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (exess) [217.215.74.195]:55371: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-10-30 16:16:18 dovecot_plain authenticator failed for (nousnes) [81.0.54.119]:36998: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 16:16:32 host2 sshd[2688052]: Disconnected from invalid user user 62.60.131.157 port 30622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-10-30 16:17:51 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:45699: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-10-30 16:17:56 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Oct 30 16:18:04 host2 sshd[2689387]: Disconnected from invalid user scan 158.51.124.122 port 60140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-10-30 16:17:33 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:39688: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-10-30 16:17:46 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:44540: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.86
country_id: 1269750
description:
2025-10-30 16:17:51 dovecot_login authenticator failed for ([182.95.21.15]) [182.95.49.86]:35950: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-10-30 16:18:15 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40300: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-10-30 16:18:33 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:40028: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-10-30 16:20:00 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:59020: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-10-30 16:19:36 dovecot_login authenticator failed for (nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:55016: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.221.28
country_id: 6251999
description:
Oct 30 16:20:31 host2 pure-ftpd[2691740]: (?@148.113.221.28) [INFO] New connection from 148.113.221.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.221.28
country_id: 6251999
description:
Oct 30 16:20:36 host2 pure-ftpd[2691847]: (?@148.113.221.28) [INFO] New connection from 148.113.221.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-10-30 16:21:19 dovecot_plain authenticator failed for (housibyst) [102.53.15.18]:53681: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-10-30 16:21:22 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (persorne) [174.59.253.88]:47898: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-10-30 16:22:40 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:56938: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Oct 30 16:22:50 host2 sshd[2693574]: Disconnected from invalid user deposito 158.51.124.122 port 43204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.166
country_id: 1269750
description:
2025-10-30 16:23:01 dovecot_login authenticator failed for ([128.185.247.7]) [125.20.253.166]:55448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.180.197.128
country_id: 3077311
description:
Oct 30 16:23:46 host2 sshd[2694342]: Disconnected from invalid user adam 90.180.197.128 port 52885 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-10-30 16:27:33 dovecot_plain authenticator failed for (lasthed) [5.11.221.119]:56596: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-10-30 16:27:37 dovecot_plain authenticator failed for (arcaculls) [65.20.129.28]:52149: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.247.69.196
country_id: 953987
description:
Oct 30 16:27:39 host2 sshd[2697612]: Disconnected from invalid user server 105.247.69.196 port 57826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-10-30 16:28:25 dovecot_plain authenticator failed for (untria) [154.144.243.93]:59058: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 16:32:03 host2 sshd[2701497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-10-30 16:33:47 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (crouns) [73.208.81.125]:37578: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.124.122
country_id: 6252001
description:
Oct 30 16:34:26 host2 sshd[2704758]: Disconnected from invalid user zhiheng 158.51.124.122 port 48590 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.64
country_id: 2635167
description:
Oct 30 16:35:35 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.64, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<l+N1Ol5Cz+hX7LBA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.71
country_id: 2635167
description:
Oct 30 16:36:08 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.71, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4lpxPF5CL8tX7LBH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.12
country_id: 2635167
description:
Oct 30 16:35:34 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.12, lip=66.85.158.91, TLS, session=<aPZsOl5C08S594kM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.58
country_id: 2635167
description:
Oct 30 16:36:41 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.58, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<DZBsPl5CJZ6594k6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.70
country_id: 2635167
description:
Oct 30 16:37:15 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.70, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<w/1nQF5C35O594lG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.58
country_id: 2635167
description:
Oct 30 16:37:48 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.58, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<fz1jQl5CE+a594k6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.247.69.196
country_id: 953987
description:
Oct 30 16:39:14 host2 sshd[2711563]: Disconnected from invalid user admin 105.247.69.196 port 50952 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.60
country_id: 2635167
description:
Oct 30 16:38:21 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5Z9cRF5CuZ9X7LA8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Oct 30 16:38:30 host2 sshd[2710356]: Disconnected from invalid user arkbeer 64.227.134.24 port 36006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Oct 30 16:38:40 host2 sshd[2710641]: Disconnected from invalid user gjs 103.249.84.18 port 57112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.50
country_id: 2635167
description:
Oct 30 16:38:54 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.50, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<3c9ZRl5C7eW594ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.51
country_id: 2635167
description:
Oct 30 16:39:28 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.51, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<bzRVSF5C44a594kz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.63
country_id: 2635167
description:
Oct 30 16:40:01 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<SbVOSl5Cm5K594k/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
country_id: 2661886
description:
2025-10-30 16:40:27 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se (lecal) [83.255.9.170]:49324: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.48
country_id: 2635167
description:
Oct 30 16:40:34 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<hgVKTF5CiYG594kw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.134.24
country_id: 1269750
description:
Oct 30 16:43:29 host2 sshd[2717050]: Disconnected from invalid user dongil 64.227.134.24 port 46536 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.16
country_id: 2635167
description:
Oct 30 16:43:29 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.16, lip=66.85.158.91, TLS, session=<hH+3Vl5C/7xX7LAQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.239.208.223
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.239.208.223 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Oct 30 16:44:50 host2 sshd[2718543]: Disconnected from invalid user local 103.249.84.18 port 32922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Oct 30 16:45:09 host2 sshd[2719081]: Disconnected from invalid user amohammadifard 64.227.134.24 port 33854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Oct 30 16:46:49 host2 sshd[2720874]: Disconnected from invalid user pzuch 64.227.134.24 port 48616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.223.25.174
country_id: 6252001
description:
2025-10-30 16:47:07 dovecot_login authenticator failed for 174.sub-75-223-25.myvzw.com [75.223.25.174]:39870: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-10-30 16:47:19 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:47218: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Oct 30 16:49:00 host2 sshd[2722642]: Disconnected from invalid user mcmurtry 103.249.84.18 port 58396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.149
country_id: 2186224
description:
2025-10-30 16:49:43 dovecot_login authenticator failed for ([121.73.161.149]) [121.73.161.149]:53500: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-10-30 16:50:00 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:32842: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.160
country_id: 6252001
description:
Oct 30 16:50:14 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=48.214.144.160, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<qFfdbl5C7ugw1pCg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-10-30 16:52:00 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (neudoper) [68.193.149.88]:47301: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-10-30 16:55:15 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (suladon) [85.225.19.144]:44087: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-10-30 16:55:53 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:57696: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-10-30 16:57:54 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:49774: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-10-30 16:58:16 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:50762: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-10-30 16:58:29 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:59577: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-10-30 16:58:55 dovecot_login authenticator failed for ([115.248.4.85]) [115.248.4.85]:58615: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-10-30 17:00:54 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:51682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.66
country_id: 1733045
description:
2025-10-30 17:01:07 dovecot_login authenticator failed for ([49.125.201.66]) [49.125.201.66]:53244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-10-30 17:02:31 dovecot_plain authenticator failed for (nosce) [102.53.15.56]:56535: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-10-30 17:04:58 dovecot_plain authenticator failed for (padogelled) [81.0.54.119]:43990: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-10-30 17:05:01 dovecot_plain authenticator failed for (dograntral) [65.20.164.137]:48468: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-10-30 17:06:02 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (coencys) [73.197.194.98]:37244: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-10-30 17:08:26 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (ovely) [73.145.107.251]:49080: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-10-30 17:12:33 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:60460: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-10-30 17:13:12 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:41224: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 17:14:25 host2 sshd[2747870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 17:20:57 host2 sshd[2753739]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-10-30 17:21:38 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:60943: 535 Incorrect authentication data (set_id=euroentertainmentlk.com@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-10-30 17:21:45 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:43802: 535 Incorrect authentication data (set_id=euroentertainmentlk.com@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-10-30 17:22:02 dovecot_login authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:49326: 535 Incorrect authentication data (set_id=euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-10-30 17:22:09 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (noniting) [81.225.30.107]:43662: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-10-30 17:22:33 dovecot_login authenticator failed for (nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:42718: 535 Incorrect authentication data (set_id=euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-10-30 17:22:48 dovecot_plain authenticator failed for (unamae) [88.248.250.143]:43742: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-10-30 17:25:13 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:44712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-10-30 17:25:33 dovecot_login authenticator failed for visaustralia.com [216.70.104.41]:49876: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 17:25:36 host2 sshd[2758204]: Disconnected from invalid user user 2.57.121.25 port 14089 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-10-30 17:27:54 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:50402: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.4
country_id: 1733045
description:
2025-10-30 17:28:20 dovecot_login authenticator failed for ([49.124.153.4]) [49.124.153.4]:51000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-10-30 17:34:35 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:40478: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.30
country_id: 1269750
description:
2025-10-30 17:34:52 dovecot_login authenticator failed for ([128.185.70.137]) [125.19.156.30]:56704: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 17:36:39 dovecot_login authenticator failed for ([1.7.229.162]) [49.37.32.248]:54988: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-10-30 17:37:13 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:38219: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.5
country_id: 1733045
description:
2025-10-30 17:39:35 dovecot_login authenticator failed for ([49.124.132.5]) [49.124.132.5]:38460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-10-30 17:39:59 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:48278: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-10-30 17:45:00 dovecot_plain authenticator failed for (cysions) [209.173.10.75]:56998: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-10-30 17:45:04 dovecot_plain authenticator failed for (antisopy) [65.20.233.110]:60401: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.122
country_id: 6252001
description:
Oct 30 17:46:46 host2 pure-ftpd[2779542]: (?@64.62.156.122) [INFO] New connection from 64.62.156.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 17:48:48 host2 sshd[2781828]: Disconnected from invalid user user 62.60.131.157 port 15990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.86.76
country_id: 6252001
description:
Oct 30 17:54:02 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.86.76, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CqAGU19CGM0ofFZM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.18
country_id: 6252001
description:
Oct 30 17:58:35 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.125.18, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<J/JRY19CAo0NWX0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.157.134
country_id: 2510769
description:
2025-10-30 18:04:06 dovecot_login authenticator failed for (47-60-157-134.red-acceso.airtel.net) [47.60.157.134]:37478: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-10-30 18:04:42 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:58346: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.100
country_id: 3686110
description:
2025-10-30 18:06:46 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.100]:1328: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.91.39.115
country_id: 1522867
description:
2025-10-30 18:07:07 dovecot_login authenticator failed for 178.91.39.115.dynamic.telecom.kz [178.91.39.115]:37223: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.39
country_id: 6252001
description:
Oct 30 18:08:59 host2 pure-ftpd[2804216]: (?@172.202.118.39) [INFO] New connection from 172.202.118.39


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Oct 30 18:09:14 host2 pure-ftpd[2804489]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Oct 30 18:09:16 host2 pure-ftpd[2804502]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Oct 30 18:09:20 host2 pure-ftpd[2804580]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-10-30 18:13:55 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:58708: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-10-30 18:15:24 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:41658: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-10-30 18:16:05 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40846: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-10-30 18:18:15 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:56494: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.68.229.183
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 138.68.229.183 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.123.173
country_id: 1819730
description:
Oct 30 18:30:25 host2 sshd[2824622]: Disconnected from invalid user ahernando 101.36.123.173 port 46316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.123.173
country_id: 1819730
description:
Oct 30 18:34:35 host2 sshd[2828352]: Disconnected from invalid user sandeepg 101.36.123.173 port 42098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-30 18:37:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63598: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.123.173
country_id: 1819730
description:
Oct 30 18:37:50 host2 sshd[2831407]: Disconnected from invalid user yeongo 101.36.123.173 port 58246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.124
country_id: 1643084
description:
Oct 30 18:40:08 host2 sshd[2833499]: Disconnected from invalid user ahernando 103.59.94.124 port 45964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-10-30 18:43:50 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:36576: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-10-30 18:44:04 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:33128: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Oct 30 18:44:44 host2 sshd[2838008]: Disconnected from invalid user localhost 20.212.241.39 port 60568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2025-10-30 18:47:08 dovecot_login authenticator failed for p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:57764: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-10-30 18:49:04 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:46874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-10-30 18:49:16 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:53280: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.183.155.190
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.183.155.190 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 18:51:29 host2 sshd[2844503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Oct 30 18:51:46 host2 sshd[2844578]: Disconnected from invalid user mfg 20.212.241.39 port 56234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-10-30 18:53:33 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:58966: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-10-30 18:53:49 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:39192: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Oct 30 18:55:05 host2 sshd[2848390]: Disconnected from invalid user test 20.212.241.39 port 51822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-10-30 18:56:49 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:34682: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-10-30 18:56:35 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:56266: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 18:58:05 host2 sshd[2851193]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-10-30 18:59:18 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:49774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-10-30 18:59:40 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:52668: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-10-30 19:01:47 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:46690: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-10-30 19:01:58 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:54206: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-10-30 19:02:00 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:39438: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-10-30 19:02:31 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:58302: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.75.235
country_id: 6252001
description:
Oct 30 19:06:18 host2 pure-ftpd[2858951]: (?@198.199.75.235) [INFO] New connection from 198.199.75.235


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Oct 30 19:08:17 host2 sshd[2860655]: Disconnected from invalid user sbabaei 57.128.182.5 port 35810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Oct 30 19:09:49 host2 sshd[2862024]: Disconnected from invalid user zeqw 57.128.182.5 port 47662 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.182.5
country_id: 2635167
description:
Oct 30 19:11:01 host2 sshd[2863348]: Disconnected from invalid user hani 57.128.182.5 port 56684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Oct 30 19:13:17 host2 sshd[2865781]: Disconnected from invalid user rma 57.128.182.5 port 35732 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.208.47
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.42.208.47 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Oct 30 19:23:37 host2 sshd[2876201]: Disconnected from invalid user suporte 103.67.78.102 port 38064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Oct 30 19:25:17 host2 sshd[2878060]: Disconnected from invalid user dasan 103.67.78.102 port 44582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.107.94.26
country_id: 3469034
description:
2025-10-30 19:28:09 dovecot_login authenticator failed for 177-107-94-26.static.dominioz.com.br [177.107.94.26]:60394: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-10-30 19:28:41 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:54000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.102
country_id: 1643084
description:
Oct 30 19:29:06 host2 sshd[2881777]: Disconnected from invalid user eyftpuser 103.67.78.102 port 44622 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.171.49
country_id: 6252001
description:
Oct 30 19:32:43 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.23.171.49, lip=66.85.158.91, TLS, session=<tzjxs2BCUKpAF6sx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.67.124.224
country_id: 2077456
description:
2025-10-30 19:34:14 dovecot_login authenticator failed for (224.124.67.202.static.nbn.dodo.com.au) [202.67.124.224]:34188: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-10-30 19:35:05 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:64493: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-10-30 19:36:58 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:34586: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-10-30 19:37:19 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:56032: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-10-30 19:37:19 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:56807: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.11.142
country_id: 241170
description:
Oct 30 19:37:41 host2 sshd[2890687]: Disconnected from invalid user icee 156.232.11.142 port 44508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-10-30 19:37:19 dovecot_login authenticator failed for (nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:44174: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-10-30 19:37:32 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:47060: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-10-30 19:37:37 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:47116: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.24
country_id: 1861060
description:
Oct 30 19:37:49 host2 sshd[2890791]: Disconnected from invalid user cxyang 163.44.99.24 port 35970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-10-30 19:39:24 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:41723: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-10-30 19:39:35 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:47966: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.232.11.142
country_id: 241170
description:
Oct 30 19:41:41 host2 sshd[2894720]: Disconnected from invalid user braza 156.232.11.142 port 42690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Oct 30 19:44:59 host2 sshd[2898196]: Disconnected from invalid user huawei 141.95.162.162 port 43898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.99.24
country_id: 1861060
description:
Oct 30 19:44:45 host2 sshd[2898035]: Disconnected from invalid user ronaldo 163.44.99.24 port 42790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Oct 30 19:46:36 host2 sshd[2900069]: Disconnected from invalid user theo 122.54.18.220 port 20375 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.162.162
country_id: 3017382
description:
Oct 30 19:47:24 host2 sshd[2900748]: Disconnected from invalid user hussain 141.95.162.162 port 51958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Oct 30 19:48:26 host2 sshd[2902054]: Disconnected from invalid user new 122.54.18.220 port 25709 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.227.16
country_id: 6252001
description:
Oct 30 19:48:33 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=104.248.227.16, lip=66.85.158.91, session=<rQqK7GBCvpxo+OMQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Oct 30 19:49:18 host2 sshd[2902835]: Disconnected from invalid user legales 141.95.162.162 port 36194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Oct 30 19:49:56 host2 sshd[2903370]: Disconnected from invalid user onkar1 122.54.18.220 port 18940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.121.73.242
country_id: 3469034
description:
Oct 30 19:56:23 host2 sshd[2910835]: Disconnected from invalid user ippony 168.121.73.242 port 33402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Oct 30 19:56:27 host2 sshd[2910856]: Disconnected from invalid user hd 154.144.225.226 port 41660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.67.127.162
country_id: 2077456
description:
Oct 30 19:55:51 host2 sshd[2910327]: Disconnected from invalid user report 152.67.127.162 port 53258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.121.73.242
country_id: 3469034
description:
Oct 30 19:58:02 host2 sshd[2912167]: Disconnected from invalid user moro 168.121.73.242 port 39932 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.148.3
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 157.245.148.3 - roundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user roundcube (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.67.127.162
country_id: 2077456
description:
Oct 30 19:58:48 host2 sshd[2912958]: Disconnected from invalid user axway 152.67.127.162 port 57136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Oct 30 19:59:51 host2 sshd[2914272]: Disconnected from invalid user mradan 154.144.225.226 port 45978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.121.73.242
country_id: 3469034
description:
Oct 30 19:59:55 host2 sshd[2914411]: Disconnected from invalid user mina 168.121.73.242 port 44276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-10-30 20:00:18 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:59229: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-10-30 20:00:48 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:33444: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.121.73.242
country_id: 3469034
description:
Oct 30 20:01:31 host2 sshd[2916300]: Disconnected from invalid user mabiao 168.121.73.242 port 44416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-10-30 20:04:04 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:51432: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-10-30 20:04:26 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:64909: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.246
country_id: 2542007
description:
Oct 30 20:06:43 host2 sshd[2921806]: Disconnected from invalid user ghhessam 196.92.7.246 port 48786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.67.127.162
country_id: 2077456
description:
Oct 30 20:06:53 host2 sshd[2921935]: Disconnected from invalid user daniel 152.67.127.162 port 50508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-10-30 20:07:02 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:37722: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-10-30 20:06:32 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:42059: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Oct 30 20:08:29 host2 sshd[2923307]: Disconnected from invalid user moro 154.144.225.226 port 55432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Oct 30 20:10:13 host2 sshd[2924941]: Disconnected from invalid user mabiao 196.92.7.247 port 46134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-10-30 20:13:08 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:43298: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Oct 30 20:13:35 host2 sshd[2927841]: Disconnected from invalid user luowh 196.92.7.246 port 36742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-10-30 20:13:39 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:41988: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.116.212.48
country_id: 2661886
description:
2025-10-30 20:15:45 dovecot_plain authenticator failed for ([10.0.0.6]) [135.116.212.48]:64345: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-10-30 20:15:52 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58218: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-10-30 20:15:30 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:50762: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-10-30 20:18:14 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:52786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-10-30 20:18:25 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:40429: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-10-30 20:18:28 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:44732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Oct 30 20:18:41 host2 sshd[2932063]: Disconnected from invalid user suwija 196.92.7.249 port 38032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-10-30 20:18:34 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:49317: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-10-30 20:20:46 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:46316: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-10-30 20:20:52 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:42896: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Oct 30 20:21:59 host2 sshd[2934918]: Disconnected from invalid user llh 196.92.7.247 port 55218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.162
country_id: 1210997
description:
Oct 30 20:28:18 host2 sshd[2940404]: Disconnected from invalid user wyy 103.86.198.162 port 34935 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 20:28:47 host2 sshd[2940765]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.155.190
country_id: 6252001
description:
Oct 30 20:30:32 host2 pure-ftpd[2942525]: (?@68.183.155.190) [INFO] New connection from 68.183.155.190


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.92.7.249
country_id: 2542007
description:
Oct 30 20:31:51 host2 sshd[2943553]: Disconnected from invalid user kozlik 196.92.7.249 port 41612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.162
country_id: 1210997
description:
Oct 30 20:34:51 host2 sshd[2946004]: Disconnected from invalid user jupyterhub 103.86.198.162 port 34383 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 20:35:21 host2 sshd[2946705]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.198.162
country_id: 1210997
description:
Oct 30 20:36:39 host2 sshd[2947628]: Disconnected from invalid user serv 103.86.198.162 port 51104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-10-30 20:42:32 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:48896: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2025-10-30 20:43:12 dovecot_login authenticator failed for ([49.124.152.208]) [49.124.152.208]:57494: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-10-30 20:46:05 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:47591: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 30 20:45:38 host2 sshd[2956910]: Disconnected from invalid user user 2.57.121.25 port 18804 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.93
country_id: 6252001
description:
Oct 30 20:47:00 host2 pure-ftpd[2958119]: (?@199.45.155.93) [INFO] New connection from 199.45.155.93


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.170
country_id: 6252001
description:
Oct 30 20:48:00 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.170, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dQ8pwWFCTtKTuYWq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.170
country_id: 6252001
description:
Oct 30 20:48:30 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.170, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X1DwwmFCAuCTuYWq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Oct 30 20:50:32 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<BT9CymFCHILPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-10-30 20:51:52 dovecot_login authenticator failed for ([125.17.198.105]) [125.19.251.90]:45988: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-10-30 20:52:23 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:58245: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 30 20:52:34 host2 sshd[2963269]: Disconnected from invalid user user 62.60.131.157 port 15531 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.170
country_id: 6252001
description:
Oct 30 20:55:26 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.170, lip=66.85.158.91, TLS, session=<4gDH22FCYPeTuYWq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.158.129.17
country_id: 2400553
description:
2025-10-30 20:57:19 dovecot_login authenticator failed for ([41.159.145.190]) [41.158.129.17]:38991: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-10-30 20:56:44 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:39706: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Oct 30 21:00:02 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<7Rk57GFCsKfPWvQO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Oct 30 21:00:55 host2 pure-ftpd[2971888]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Oct 30 21:04:07 host2 pure-ftpd[2975410]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.137.121.193
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 64.137.121.193 - topview "GET /execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.73.250.128
country_id: 357994
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 154.73.250.128 - topviewl "GET /execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.225.2.78
country_id: 2661886
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.225.2.78 - admin_venee "GET /execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-10-30 21:21:35 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:54190: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2025-10-30 21:21:58 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:43478: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.232
country_id: 6252001
description:
Oct 30 21:24:09 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.232, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ONx0QmJCkduTuYTo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-10-30 21:24:47 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:51914: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.211.157
country_id: 2921044
description:
Oct 30 21:25:01 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=139.59.211.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Sf6VRWJCfL2LO9Od>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-10-30 21:25:04 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:43966: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.38.102.187
country_id: 130758
description:
2025-10-30 21:28:20 dovecot_plain authenticator failed for (proglierds) [89.38.102.187]:51374: 535 Incorrect authentication data (set_id=maximsholdings.com@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.232
country_id: 6252001
description:
Oct 30 21:29:40 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.232, lip=66.85.158.92, TLS, session=<KYoxVmJC+veTuYTo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 21:30:29 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:40742: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-10-30 21:31:03 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:59442: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-10-30 21:32:33 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:44008: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-10-30 21:32:54 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:41940: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.240
country_id: 2635167
description:
Oct 30 21:33:42 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.240, lip=66.85.158.91, TLS, session=<g+SiZGJCTeVX7LDw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.28
country_id: 2635167
description:
Oct 30 21:33:44 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NeW4ZGJC2am594kc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.13
country_id: 2635167
description:
Oct 30 21:34:17 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.13, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Pza0ZmJCO5ZX7LAN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Oct 30 21:35:24 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<pfOqamJCa+y594kh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2025-10-30 21:35:30 dovecot_login authenticator failed for (88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:40604: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-10-30 21:35:43 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:42868: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.16
country_id: 2635167
description:
Oct 30 21:35:57 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.16, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<hy2mbGJC77NX7LAQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.32
country_id: 2635167
description:
Oct 30 21:36:30 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.32, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Y2ilbmJCcdZX7LAg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Oct 30 21:36:49 host2 sshd[3005606]: Disconnected from invalid user cron 81.215.228.18 port 39650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.6
country_id: 2635167
description:
Oct 30 21:37:04 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.6, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SO6icGJC4aVX7LAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Oct 30 21:37:37 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<jSiecmJC1Yq594kh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Oct 30 21:37:45 host2 sshd[3006517]: Disconnected from invalid user caotian 35.244.25.124 port 34366 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.15
country_id: 2635167
description:
Oct 30 21:38:10 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<q6uXdGJCw6O594kP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.20
country_id: 2635167
description:
Oct 30 21:38:43 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<uv6SdmJCjY1X7LAU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Oct 30 21:40:03 host2 sshd[3008817]: Disconnected from invalid user ubuntu 81.215.228.18 port 43562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Oct 30 21:40:57 host2 sshd[3009786]: Disconnected from invalid user vodafone 35.244.25.124 port 37830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Oct 30 21:42:34 host2 sshd[3011174]: Disconnected from invalid user sbi 81.215.228.18 port 47426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.227.16
country_id: 6252001
description:
Oct 30 21:43:37 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.227.16, lip=66.85.158.92, session=<7mMViGJCVpJo+OMQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Oct 30 21:43:47 host2 sshd[3012251]: Disconnected from invalid user brian 81.215.228.18 port 49356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.244.25.124
country_id: 1269750
description:
Oct 30 21:45:24 host2 sshd[3014739]: Disconnected from invalid user santos 35.244.25.124 port 43022 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.162
country_id: 6252001
description:
Oct 30 21:46:38 host2 pure-ftpd[3015946]: (?@64.62.156.162) [INFO] New connection from 64.62.156.162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Oct 30 21:57:49 host2 sshd[3038784]: Disconnected from invalid user anahita 83.229.122.23 port 45814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-10-30 21:59:17 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:51250: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Oct 30 21:59:19 host2 sshd[3040360]: Disconnected from invalid user zhangyiming 83.229.122.23 port 36358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2025-10-30 21:59:58 dovecot_login authenticator failed for ([49.124.154.173]) [49.124.154.173]:40904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-10-30 22:01:20 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (ptivic) [71.62.34.216]:39706: 535 Incorrect authentication data (set_id=euroentertainmentlk.com@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 22:01:52 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:58670: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-10-30 22:02:05 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3026: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Oct 30 22:02:13 host2 sshd[3043113]: Disconnected from invalid user agirisha 83.229.122.23 port 34534 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 22:05:42 host2 sshd[3046434]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.11.130
country_id: 6252001
description:
Oct 30 22:06:05 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.11.130, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dABo2GJC4NUUqAuC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-10-30 22:08:03 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:54542: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-10-30 22:08:40 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:7487: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Oct 30 22:09:47 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oqen5WJCLJBBMQF6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.125
country_id: 6252001
description:
Oct 30 22:09:28 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mL6E5GJCmzJBMQF9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-10-30 22:10:39 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:50172: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Oct 30 22:09:57 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.122, lip=66.85.158.91, TLS: Connection closed, session=<kkpE5mJCsnFBMQF6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-10-30 22:10:19 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:40894: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Oct 30 22:11:27 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<Qn6l62JCAqJChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-10-30 22:10:57 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (coarmate) [98.222.93.199]:41302: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-10-30 22:11:03 dovecot_plain authenticator failed for (equidow) [65.20.148.194]:51190: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-10-30 22:13:16 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:45648: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-10-30 22:13:03 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:59960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-10-30 22:16:48 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:51604: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.160.53
country_id: 290557
description:
2025-10-30 22:17:24 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:33868: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 3.90.224.199
country_id: 6252001
description:
Oct 30 22:25:17 host2 sshd[3063656]: Disconnected from invalid user contraloria 3.90.224.199 port 48336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Oct 30 22:34:13 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ejsCPWNCRuVBMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.47
country_id: 1733045
description:
2025-10-30 22:38:11 dovecot_login authenticator failed for ([49.124.153.47]) [49.124.153.47]:53648: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-10-30 22:38:51 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:50630: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-30 22:38:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56141: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-10-30 22:41:19 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:36618: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-10-30 22:41:42 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:48641: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.58.120
country_id: 2921044
description:
Oct 30 22:43:39 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.193.58.120, lip=66.85.158.92, session=<DX6/XmNC6Nh2wTp4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.193.58.120
country_id: 2921044
description:
Oct 30 22:43:40 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.58.120, lip=66.85.158.92, session=<hs/RXmNC4Nl2wTp4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-10-30 22:48:00 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:36088: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-10-30 22:48:37 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:37125: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 138.117.78.106
country_id: 3865483
description:
Oct 30 22:49:17 host2 pure-ftpd[3089068]: (?@138.117.78.106) [WARNING] Authentication failed for user [training@v-deploy.com]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.117.78.106
country_id: 3865483
description:
Oct 30 22:49:12 host2 sshd[3089067]: Invalid user training@v-deploy.com from 138.117.78.106 port 60032


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.117.78.106
country_id: 3865483
description:
Oct 30 22:49:11 host2 pure-ftpd[3089068]: (?@138.117.78.106) [INFO] New connection from 138.117.78.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-10-30 22:50:17 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:44712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-10-30 22:50:32 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:52412: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 22:53:27 host2 sshd[3093053]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-10-30 22:53:34 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35973: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Oct 30 22:54:15 host2 sshd[3093714]: Disconnected from invalid user zx 35.240.75.51 port 54798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.131.233
country_id: 6252001
description:
Oct 30 22:55:25 host2 sshd[3095225]: Disconnected from invalid user centos 206.217.131.233 port 46346 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 30 22:59:56 host2 sshd[3099343]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.240.75.51
country_id: 2802361
description:
Oct 30 23:02:53 host2 sshd[3101955]: Disconnected from invalid user user2 35.240.75.51 port 45326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.228.11.195
country_id: 6252001
description:
2025-10-30 23:07:08 dovecot_plain authenticator failed for c-71-228-11-195.hsd1.il.comcast.net (tronvol) [71.228.11.195]:59614: 535 Incorrect authentication data (set_id=euroentertainmentlk.com@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Oct 30 23:14:51 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<Oc1czmNCFBbY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Oct 30 23:15:13 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XP6tz2NCzmlAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Oct 30 23:15:49 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS: Connection closed, session=</mXV0WNCCOpAPsUC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-10-30 23:19:52 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:32057: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-10-30 23:20:26 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.32.248]:44196: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.65
country_id: 798544
description:
2025-10-30 23:22:40 dovecot_login authenticator failed for (65.81.41.31.ip4.feromedia.eu) [31.41.81.65]:58293: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.131.165.45
country_id: 2661886
description:
2025-10-30 23:22:51 dovecot_login authenticator failed for ([88.131.165.45]) [88.131.165.45]:60824: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.214.60.73
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 85.214.60.73 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-10-30 23:26:13 dovecot_plain authenticator failed for (conaskier) [24.53.38.51]:45067: 535 Incorrect authentication data (set_id=euroentertainmentlk@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-10-30 23:28:34 dovecot_login authenticator failed for ([191.36.154.175]) [191.36.154.175]:54412: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.60
country_id: 3624060
description:
2025-10-30 23:28:55 dovecot_login authenticator failed for ([186.177.88.60]) [186.177.88.60]:38013: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.254.22
country_id: 2750405
description:
Oct 30 23:30:35 host2 sshd[3128577]: Disconnected from invalid user mysite 130.185.254.22 port 51482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-10-30 23:30:48 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:44988: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.53
country_id: 1733045
description:
2025-10-30 23:31:03 dovecot_login authenticator failed for ([49.124.149.53]) [49.124.149.53]:36910: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.47.2.69
country_id: 3057568
description:
2025-10-30 23:33:29 dovecot_login authenticator failed for adsl-d69.84-47-2.t-com.sk [84.47.2.69]:53001: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-10-30 23:33:50 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:52201: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.109.244.181
country_id: 1835841
description:
Oct 30 23:34:56 host2 sshd[3132104]: Disconnected from invalid user admin 150.109.244.181 port 38656 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.185.254.22
country_id: 2750405
description:
Oct 30 23:36:38 host2 sshd[3133758]: Disconnected from invalid user sharief 130.185.254.22 port 45342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.109.244.181
country_id: 1835841
description:
Oct 30 23:38:23 host2 sshd[3135013]: Disconnected from invalid user sk 150.109.244.181 port 60160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.9
country_id: 6252001
description:
Oct 30 23:38:53 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.9, lip=66.85.158.91, session=<PyxVJGRC25pAPsUJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Oct 30 23:39:07 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS: Connection closed, session=<8Q0jJWRCTrNAPsUC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.254.22
country_id: 2750405
description:
Oct 30 23:40:10 host2 sshd[3136746]: Disconnected from invalid user minecraft 130.185.254.22 port 54216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Oct 30 23:40:44 host2 sshd[3137144]: Disconnected from invalid user asun 8.213.197.49 port 33994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.109.244.181
country_id: 1835841
description:
Oct 30 23:40:04 host2 sshd[3136642]: Disconnected from invalid user ubuntu 150.109.244.181 port 33280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Oct 30 23:42:26 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K/4GMWRCFuBChJmC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.109.244.181
country_id: 1835841
description:
Oct 30 23:41:49 host2 sshd[3138021]: Disconnected from invalid user amina 150.109.244.181 port 33281 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-10-30 23:44:58 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (makis) [73.145.107.251]:60510: 535 Incorrect authentication data (set_id=maximsholdings.com@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.226.228
country_id: 1643084
description:
Oct 30 23:48:34 host2 pure-ftpd[3145247]: (?@182.8.226.228) [INFO] New connection from 182.8.226.228


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.228
country_id: 1643084
description:
Oct 30 23:48:37 host2 sshd[3145251]: Invalid user cloudtourssrilan_travel from 182.8.226.228 port 21740


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.226.228
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 182.8.226.228 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.28
country_id: 3175395
description:
Oct 30 23:52:32 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=171.22.234.28, lip=66.85.158.91, TLS, session=<VMj1U2RCIaurFuoc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.199
country_id: 953987
description:
Oct 30 23:53:03 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<training>, method=PLAIN, rip=102.64.35.199, lip=66.85.158.91, TLS, session=<4eaEVWRChOhmQCPH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-10-30 23:58:00 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:50286: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-10-30 23:58:24 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:55042: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.185.40.6
country_id: 617790
description:
2025-10-31 00:00:25 dovecot_login authenticator failed for (host-static-109-185-40-6.moldtelecom.md) [109.185.40.6]:51677: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.65
country_id: 1733045
description:
2025-10-31 00:00:43 dovecot_login authenticator failed for ([49.125.201.65]) [49.125.201.65]:36148: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 50.116.26.161
country_id: 6252001
description:
Oct 31 00:06:31 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=50.116.26.161, lip=66.85.158.91, session=<Kg4oh2RC0IcydBqh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.232
country_id: 1733045
description:
2025-10-31 00:07:00 dovecot_login authenticator failed for ([49.124.152.232]) [49.124.152.232]:39414: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-10-31 00:07:24 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:45412: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-10-31 00:08:06 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (nezabled) [74.218.95.154]:59174: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Oct 31 00:08:28 host2 sshd[3164056]: Disconnected from invalid user web1 8.213.197.49 port 44982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2025-10-31 00:08:53 dovecot_login authenticator failed for ([49.124.155.174]) [49.124.155.174]:37898: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2025-10-31 00:09:48 dovecot_login authenticator failed for ([49.125.201.89]) [49.125.201.89]:39858: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-10-31 00:11:40 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:45532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.227.174.34
country_id: 6252001
description:
2025-10-31 00:11:59 dovecot_login authenticator failed for ([216.227.174.34]) [216.227.174.34]:50778: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.77
country_id: 6252001
description:
Oct 31 00:18:40 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.77, lip=66.85.158.92, TLS, session=<b1mZsmRCQOjN0h9N>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.75.235
country_id: 6252001
description:
Oct 31 00:19:00 host2 pure-ftpd[3173927]: (?@198.199.75.235) [INFO] New connection from 198.199.75.235


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.213.197.49
country_id: 1605651
description:
Oct 31 00:26:53 host2 sshd[3181280]: Disconnected from invalid user aleeza 8.213.197.49 port 56818 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 00:29:16 host2 sshd[3183448]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-10-31 00:31:02 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (traces) [68.46.148.180]:46068: 535 Incorrect authentication data (set_id=maximsholdings@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-10-31 00:35:40 dovecot_plain authenticator failed for (coacheadal) [65.20.149.93]:39242: 535 Incorrect authentication data (set_id=euroentertainmentlk@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 00:35:41 host2 sshd[3189471]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-10-31 00:36:11 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:58708: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.228
country_id: 6252001
description:
Oct 31 00:37:08 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.228, lip=66.85.158.92, TLS, session=<u3Sc9GRClO7N0h/k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.124
country_id: 6252001
description:
Oct 31 00:38:50 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.117.124, lip=66.85.158.92, session=<ffm0+mRCoIOsynV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-10-31 00:38:53 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:59916: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.87
country_id: 1733045
description:
2025-10-31 00:38:41 dovecot_login authenticator failed for ([49.125.201.87]) [49.125.201.87]:38268: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Oct 31 00:39:42 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.232, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7nvS/WRC85fDuEzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Oct 31 00:39:59 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=195.184.76.13, lip=66.85.158.91, TLS: Connection closed, session=<XOvN/mRCadTDuEwN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Oct 31 00:40:39 host2 sshd[3194077]: Disconnected from invalid user minecraft 8.213.197.49 port 39168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-10-31 00:44:52 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:43362: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-10-31 00:45:27 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45420: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-10-31 00:46:55 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:45391: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-10-31 00:47:23 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:38416: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.211.96
country_id: 1210997
description:
2025-10-31 00:49:50 dovecot_login authenticator failed for ([103.129.211.96]) [103.129.211.96]:56897: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-10-31 00:50:17 dovecot_login authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:45962: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.253
country_id: 1880251
description:
Oct 31 00:53:57 host2 sshd[3206843]: Disconnected from invalid user oguz 45.78.217.253 port 33216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Oct 31 00:57:13 host2 sshd[3210445]: Disconnected from invalid user shopify 182.48.68.82 port 44964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.68.82
country_id: 1210997
description:
Oct 31 00:58:58 host2 sshd[3211740]: Disconnected from invalid user safeuser 182.48.68.82 port 50770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.253
country_id: 1880251
description:
Oct 31 01:00:58 host2 sshd[3213752]: Disconnected from invalid user loki 45.78.217.253 port 39404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Oct 31 01:02:09 host2 sshd[3214915]: Disconnected from invalid user natalia 182.48.68.82 port 48184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.253
country_id: 1880251
description:
Oct 31 01:11:52 host2 sshd[3224841]: Disconnected from invalid user qwe 45.78.217.253 port 32814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-10-31 01:14:39 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:61119: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.198
country_id: 1819730
description:
Oct 31 01:16:01 host2 sshd[3228803]: Disconnected from invalid user xhekuacenet 154.83.16.198 port 33610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-10-31 01:17:18 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:53899: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-10-31 01:17:35 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:56030: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.198
country_id: 1819730
description:
Oct 31 01:19:24 host2 sshd[3231826]: Disconnected from invalid user jcares 154.83.16.198 port 57494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.16.198
country_id: 1819730
description:
Oct 31 01:20:47 host2 sshd[3233283]: Disconnected from invalid user juano 154.83.16.198 port 59678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.198
country_id: 1819730
description:
Oct 31 01:22:20 host2 sshd[3234674]: Disconnected from invalid user dmcgregor 154.83.16.198 port 33482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-10-31 01:23:34 dovecot_login authenticator failed for (49.207.9.39.actcorp.in) [49.207.9.39]:61115: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.198
country_id: 1819730
description:
Oct 31 01:23:42 host2 sshd[3235723]: Disconnected from invalid user luanmanahasa 154.83.16.198 port 35494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2025-10-31 01:23:18 dovecot_login authenticator failed for (telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:49231: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-10-31 01:25:40 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:57022: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-10-31 01:26:02 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:41928: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.44.203.210
country_id: 2661886
description:
2025-10-31 01:27:59 dovecot_login authenticator failed for h5-44-203-210.cust.bredband2.com [5.44.203.210]:54243: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.143
country_id: 1733045
description:
2025-10-31 01:28:11 dovecot_login authenticator failed for ([49.124.152.143]) [49.124.152.143]:57392: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.194
country_id: 6252001
description:
Oct 31 01:28:14 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.194, lip=66.85.158.91, session=<v0Ncq2VCHpUUQGnC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.235.151
country_id: 2635167
description:
Oct 31 01:41:15 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.235.151, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LCjp2WVCOrml4+uX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.127.26.32
country_id: 3469034
description:
Oct 31 01:45:23 host2 sshd[3255517]: Disconnected from invalid user ben 179.127.26.32 port 34188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Oct 31 01:48:43 host2 sshd[3258425]: Disconnected from invalid user upload 27.254.137.144 port 46316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Oct 31 01:48:23 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<U2tn82VC1q5HBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Oct 31 01:49:18 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.92, session=<RVeu9mVCtqrAm1rc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Oct 31 01:50:07 host2 sshd[3259780]: Disconnected from invalid user taufik 27.254.137.144 port 48248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-10-31 01:52:28 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:58598: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-10-31 01:55:12 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:48957: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-10-31 01:55:50 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:57799: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-10-31 01:58:41 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:56867: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-10-31 01:58:50 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:52063: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Oct 31 01:59:47 host2 sshd[3268928]: Disconnected from invalid user rajesh 103.51.216.210 port 55188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-10-31 02:02:00 dovecot_login authenticator failed for (nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:48356: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-10-31 02:01:37 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:42998: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Oct 31 02:02:38 host2 sshd[3271519]: Disconnected from invalid user koha1 92.191.96.115 port 18728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.51.216.210
country_id: 1269750
description:
Oct 31 02:03:53 host2 sshd[3272942]: Disconnected from invalid user testadmin 103.51.216.210 port 35996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-10-31 02:03:58 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:43078: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-10-31 02:04:23 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:43712: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 02:04:48 host2 sshd[3273910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Oct 31 02:06:06 host2 sshd[3275265]: Disconnected from invalid user selmannezha 198.12.86.4 port 45070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Oct 31 02:06:38 host2 sshd[3275633]: Disconnected from invalid user eddie 92.191.96.115 port 24854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-10-31 02:06:51 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:53580: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.3.36.154
country_id: 298795
description:
2025-10-31 02:07:01 dovecot_login authenticator failed for (95.3.36.154.static.ttnet.com.tr) [95.3.36.154]:38430: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Oct 31 02:08:02 host2 sshd[3277171]: Disconnected from invalid user xjw 95.39.201.205 port 58740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-10-31 02:07:46 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:35544: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-10-31 02:07:53 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:42494: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.86.4
country_id: 6252001
description:
Oct 31 02:09:56 host2 sshd[3278761]: Disconnected from invalid user abatjargal 198.12.86.4 port 51890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.159.131.219
country_id: 783754
description:
Oct 31 02:09:15 host2 sshd[3278200]: Disconnected from invalid user dandan 78.159.131.219 port 46820 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 02:11:19 host2 sshd[3280205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-10-31 02:15:46 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (extivake) [81.225.30.107]:54838: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-10-31 02:15:53 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (dolveriton) [73.168.136.150]:34476: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Oct 31 02:15:29 host2 sshd[3284033]: Disconnected from invalid user mapadmin 103.189.89.76 port 54630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-10-31 02:17:07 dovecot_plain authenticator failed for (amistalia) [88.149.153.106]:41125: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Oct 31 02:17:26 host2 sshd[3285630]: Disconnected from invalid user appltest 95.39.201.205 port 60534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.159.131.219
country_id: 783754
description:
Oct 31 02:18:35 host2 sshd[3286509]: Disconnected from invalid user 11 78.159.131.219 port 48448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.159.131.219
country_id: 783754
description:
Oct 31 02:19:42 host2 sshd[3287469]: Disconnected from invalid user jumpserver 78.159.131.219 port 38074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Oct 31 02:20:53 host2 sshd[3288793]: Disconnected from invalid user hpscan 103.189.89.76 port 35392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Oct 31 02:21:02 host2 sshd[3288933]: Disconnected from invalid user mapadmin 95.39.201.205 port 49072 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.122.182
country_id: 290557
description:
[2025-10-31 02:22:06 +0530] info [whostmgrd] 176.205.122.182 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.89.76
country_id: 1880251
description:
Oct 31 02:22:17 host2 sshd[3289855]: Disconnected from invalid user z 103.189.89.76 port 37734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-31 02:22:55 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:41818: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-10-31 02:23:21 dovecot_plain authenticator failed for (dendocrary) [5.32.22.218]:38361: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-10-31 02:23:23 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:40249: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 02:30:46 host2 sshd[3297377]: Disconnected from invalid user user 2.57.121.25 port 53182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.102
country_id: 1269750
description:
2025-10-31 02:31:17 dovecot_login authenticator failed for ([125.19.84.9]) [122.184.123.102]:47612: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-10-31 02:31:30 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:36066: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.20
country_id: 1733045
description:
2025-10-31 02:34:04 dovecot_login authenticator failed for ([49.124.149.20]) [49.124.149.20]:36110: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-10-31 02:34:21 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:42205: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-10-31 02:35:09 dovecot_plain authenticator failed for (unnadist) [91.73.188.251]:41649: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-10-31 02:41:17 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:50164: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-10-31 02:41:45 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:37690: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-10-31 02:43:05 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:60644: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-10-31 02:43:41 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:54853: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-10-31 02:44:49 dovecot_login authenticator failed for ([37.57.69.227]) [37.57.69.227]:39094: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-10-31 02:44:52 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:63966: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-10-31 02:44:58 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:46886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-10-31 02:45:02 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:47518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 02:45:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58112: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-10-31 02:45:57 dovecot_plain authenticator failed for (lobint) [75.97.190.237]:50310: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-10-31 02:46:01 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:33604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.228
country_id: 1643084
description:
Oct 31 02:46:06 host2 sshd[3311818]: Invalid user cloudtourssrilan_travel from 182.8.226.228 port 62784


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.226.228
country_id: 1643084
description:
Oct 31 02:46:05 host2 pure-ftpd[3311812]: (?@182.8.226.228) [INFO] New connection from 182.8.226.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.124
country_id: 294640
description:
2025-10-31 02:46:18 dovecot_login authenticator failed for ([2.55.70.124]) [2.55.70.124]:36058: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.3
country_id: 1605651
description:
Oct 31 02:56:54 host2 sshd[3323407]: Disconnected from invalid user zhaoruowen 27.254.235.3 port 45730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-10-31 02:57:53 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:41818: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.3
country_id: 1605651
description:
Oct 31 02:58:39 host2 sshd[3325277]: Disconnected from invalid user asc 27.254.235.3 port 48132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.3
country_id: 1605651
description:
Oct 31 03:00:27 host2 sshd[3327339]: Disconnected from invalid user cri 27.254.235.3 port 50532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Oct 31 03:01:17 host2 sshd[3328509]: Disconnected from invalid user ash 165.227.32.198 port 53772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Oct 31 03:01:39 host2 sshd[3328853]: Disconnected from invalid user oracle 82.24.64.116 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.194.63
country_id: 1880251
description:
Oct 31 03:05:08 host2 sshd[3334150]: Disconnected from invalid user ash 45.78.194.63 port 35492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Oct 31 03:05:56 host2 sshd[3335065]: Disconnected from invalid user test 165.227.32.198 port 41218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.116
country_id: 2635167
description:
Oct 31 03:06:45 host2 sshd[3335789]: Disconnected from invalid user anto 82.24.64.116 port 41658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.32.198
country_id: 6251999
description:
Oct 31 03:13:28 host2 sshd[3344418]: Disconnected from invalid user vnc 165.227.32.198 port 45048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-10-31 03:15:03 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:35377: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-10-31 03:15:38 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:50844: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Oct 31 03:16:52 host2 sshd[3348185]: Disconnected from invalid user admin 185.193.240.246 port 37062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.194.63
country_id: 1880251
description:
Oct 31 03:17:27 host2 sshd[3347805]: Disconnected from invalid user claudia 45.78.194.63 port 33890 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:19:13 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Z7RBOGdCuqoDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Oct 31 03:19:40 host2 sshd[3351067]: Disconnected from invalid user riccardo 185.193.240.246 port 54738 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:20:42 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<WJWSPWdCsoQDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-10-31 03:21:39 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:41654: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.194.63
country_id: 1880251
description:
Oct 31 03:22:04 host2 sshd[3353621]: Disconnected from invalid user dimas 45.78.194.63 port 38040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.112.141.71
country_id: 3895114
description:
Oct 31 03:21:36 host2 sshd[3353235]: Disconnected from invalid user client 159.112.141.71 port 47210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.23
country_id: 1733045
description:
2025-10-31 03:22:11 dovecot_login authenticator failed for ([49.124.151.23]) [49.124.151.23]:39280: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:22:44 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1R/dRGdC+LkDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.51
country_id: 1733045
description:
2025-10-31 03:23:40 dovecot_login authenticator failed for ([49.124.153.51]) [49.124.153.51]:52792: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.112.141.71
country_id: 3895114
description:
Oct 31 03:23:46 host2 sshd[3355284]: Disconnected from invalid user zentao 159.112.141.71 port 60688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Oct 31 03:24:24 host2 sshd[3355863]: Disconnected from invalid user kb 104.168.101.178 port 43760 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:24:28 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tucJS2dCSuwDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-10-31 03:24:44 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:37068: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:26:04 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LuDLUGdCvogDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:26:21 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<q0rJUWdCvuQDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-10-31 03:26:22 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:37760: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-10-31 03:26:34 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:57942: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Oct 31 03:28:09 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<y/U0WGdC8cLN0h/E>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.194.63
country_id: 1880251
description:
Oct 31 03:27:31 host2 sshd[3359050]: Disconnected from invalid user test 45.78.194.63 port 41400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:27:50 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Ll4eV2dCaOUDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Oct 31 03:27:54 host2 sshd[3359489]: Disconnected from invalid user wangfangzheng 104.168.101.178 port 54444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:28:55 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DS79WmdCdqcDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.101.178
country_id: 6252001
description:
Oct 31 03:29:23 host2 sshd[3361065]: Disconnected from invalid user ghbcshopadmin 104.168.101.178 port 42138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 03:30:35 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<MxDvYGdCApIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.117
country_id: 3017382
description:
Oct 31 03:33:34 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.117, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wz6ca2dCw81bxJh1>


plugin: ossec
rule: 2840
description:
Oct 31 03:35:01 host2 CROND[3366429]: (root) CMD (/usr/bin/update_cpanelv2 --ssl-services &>/dev/null)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Oct 31 03:34:15 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.31, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NmYMbmdCr+BbxJgf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.112.141.71
country_id: 3895114
description:
Oct 31 03:36:55 host2 sshd[3368581]: Disconnected from invalid user alan 159.112.141.71 port 43088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.156
country_id: 1733045
description:
2025-10-31 03:38:38 dovecot_login authenticator failed for ([183.171.7.156]) [183.171.7.156]:35394: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-10-31 03:39:15 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:51856: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 03:40:17 host2 sshd[3372329]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.191.101
country_id: 2921044
description:
Oct 31 03:40:39 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=138.197.191.101, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Lp7qhGdCQLKKxb9l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-10-31 03:42:25 dovecot_plain authenticator failed for (tercrechic) [154.144.243.93]:48626: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-31 03:44:35 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:47409: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-10-31 03:44:49 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:47168: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-10-31 03:44:50 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:60221: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-10-31 03:45:09 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37530: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-10-31 03:44:35 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:56954: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.255.145.253
country_id: 6252001
description:
2025-10-31 03:45:19 dovecot_login authenticator failed for (50-255-145-253-static.hfc.comcastbusiness.net) [50.255.145.253]:43286: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 03:46:42 host2 sshd[3380466]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.238.55.194
country_id: 6252001
description:
2025-10-31 03:49:42 dovecot_plain authenticator failed for (crousabous) [50.238.55.194]:5622: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-10-31 03:50:25 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:45046: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.33.53.162
country_id: 3865483
description:
2025-10-31 03:50:40 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.33.53.162]:56594: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-10-31 03:54:00 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57367: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.54.246
country_id: 3865483
description:
2025-10-31 03:53:23 dovecot_login authenticator failed for ([170.83.54.246]) [170.83.54.246]:52162: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.162
country_id: 6252001
description:
Oct 31 03:57:52 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<HRSEwmdCRNPG6xii>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-10-31 03:59:35 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:41580: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2025-10-31 03:59:51 dovecot_login authenticator failed for (abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:38785: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-10-31 04:01:28 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:65284: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.161.202
country_id: 290557
description:
2025-10-31 04:01:50 dovecot_login authenticator failed for ([87.201.161.202]) [87.201.161.202]:41498: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-10-31 04:04:44 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:50911: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Oct 31 04:08:17 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rNvH52dCLOkDgmBb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.235
country_id: 2635167
description:
Oct 31 04:09:42 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.235, lip=66.85.158.92, TLS, session=<i9XX7GdCHdNX7LDr>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.80
country_id: 2264397
description:
Oct 31 04:09:17 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.80, lip=66.85.158.91, TLS, session=<0C5U62dCk+otnIFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.80
country_id: 2264397
description:
Oct 31 04:09:17 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.80, lip=66.85.158.91, TLS, session=<E9NY62dCudAtnIFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.81
country_id: 2264397
description:
Oct 31 04:09:17 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<Eipa62dCJ5stnIFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.82
country_id: 2264397
description:
Oct 31 04:09:18 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.82, lip=66.85.158.91, TLS, session=<OFpo62dCfZUtnIFS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Oct 31 04:11:31 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<O9JR82dCWpUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Oct 31 04:12:37 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<UkxD92dCho8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Oct 31 04:15:34 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<fYTIAWhCMJQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-10-31 04:22:10 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:35994: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-10-31 04:22:56 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:59532: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-10-31 04:28:20 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:40515: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-10-31 04:28:40 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:59518: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-10-31 04:29:11 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:49761: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-10-31 04:29:37 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:40342: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.209
country_id: 1733045
description:
2025-10-31 04:30:00 dovecot_login authenticator failed for ([49.124.149.209]) [49.124.149.209]:53886: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.72
country_id: 3374766
description:
2025-10-31 04:31:08 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:48084: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.199.10.82
country_id: 3175395
description:
2025-10-31 04:31:42 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:48314: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 04:36:44 host2 sshd[3447286]: Disconnected from invalid user user 62.60.131.157 port 5994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-10-31 04:37:04 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:55492: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-10-31 04:37:16 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:41328: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-10-31 04:39:08 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:43214: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-10-31 04:39:20 dovecot_plain authenticator failed for (quist) [65.20.251.71]:54051: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-10-31 04:39:23 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:50909: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-10-31 04:41:57 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:44037: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-10-31 04:42:33 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56040: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.233.119
country_id: 2661886
description:
2025-10-31 04:43:30 dovecot_plain authenticator failed for c188-150-233-119.bredband.tele2.se (pating) [188.150.233.119]:47364: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-10-31 04:45:06 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:50964: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
country_id: 290291
description:
2025-10-31 04:45:36 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:54051: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-10-31 04:45:23 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:45494: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-10-31 04:45:37 dovecot_login authenticator failed for ([165.220.130.160]) [165.220.130.160]:58838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.218.241.58
country_id: 1819730
description:
Oct 31 04:49:37 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.218.241.58, lip=66.85.158.92, session=<RzSMe2hCPNJn2vE6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.108.228.15
country_id: 2510769
description:
Oct 31 04:54:57 host2 dovecot[1612370]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=79.108.228.15, lip=66.85.158.91, TLS, session=<Z7p+jmhC6WVPbOQP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 04:57:58 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<n8xsmWhCesUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 04:59:27 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<eF63nmhCHu0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-10-31 05:00:08 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:33603: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-31 05:00:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (twablypta) [87.103.126.54]:19185: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-10-31 05:00:17 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:40796: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-10-31 05:00:01 dovecot_plain authenticator failed for (hoeum) [65.20.205.197]:59629: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 05:01:35 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<KtJbpmhCSowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 05:01:39 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<v9uhpmhC1IoDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 05:02:00 host2 sshd[3475055]: Disconnected from invalid user user 62.60.131.157 port 8504 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 05:02:56 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<opIxq2hCrr4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 05:03:23 host2 dovecot[1612370]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<H7fUrGhCpOUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Oct 31 05:05:29 host2 dovecot[1612370]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<ltRWtGhCOpkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-10-31 05:06:30 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:47276: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-10-31 05:06:42 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:44164: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-10-31 05:08:48 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:44972: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-10-31 05:09:01 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:43359: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.233.57.93
country_id: 290557
description:
Oct 31 05:10:43 host2 sshd[3484902]: Disconnected from invalid user sgutierrez 20.233.57.93 port 56172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Oct 31 05:12:14 host2 sshd[3486571]: Disconnected from invalid user api_user1 118.193.43.244 port 36440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.28.238
country_id: 6252001
description:
2025-10-31 05:12:31 dovecot_login authenticator failed for (syn-024-168-028-238.res.spectrum.com) [24.168.28.238]:57884: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-10-31 05:12:42 dovecot_login authenticator failed for ([59.145.114.82]) [128.185.219.2]:45342: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Oct 31 05:12:59 host2 sshd[3487352]: Disconnected from invalid user dat 57.128.173.133 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.233.57.93
country_id: 290557
description:
Oct 31 05:13:37 host2 sshd[3487935]: Disconnected from invalid user testftp1 20.233.57.93 port 52807 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 05:15:30 host2 sshd[3489944]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-10-31 05:15:16 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:39080: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-10-31 05:14:55 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:38106: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.185
country_id: 290557
description:
Oct 31 05:15:05 host2 sshd[3489491]: Disconnected from invalid user gitlab 20.74.129.185 port 35253 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Oct 31 05:15:13 host2 sshd[3489653]: Disconnected from invalid user fts 57.128.173.133 port 49010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 05:15:16 host2 sshd[3489674]: Disconnected from invalid user user 2.57.121.25 port 24623 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.173.133
country_id: 3017382
description:
Oct 31 05:16:27 host2 sshd[3491066]: Disconnected from invalid user yogesh 57.128.173.133 port 52568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Oct 31 05:16:31 host2 sshd[3491114]: Disconnected from invalid user user 20.74.129.186 port 3644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.30
country_id: 1733045
description:
2025-10-31 05:17:02 dovecot_login authenticator failed for ([49.124.153.30]) [49.124.153.30]:41090: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-10-31 05:17:31 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:53334: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Oct 31 05:17:54 host2 sshd[3492320]: Disconnected from invalid user bernardo 23.95.37.90 port 42824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Oct 31 05:17:58 host2 sshd[3492397]: Disconnected from invalid user meliana 20.74.129.186 port 63952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.37.90
country_id: 6252001
description:
Oct 31 05:19:07 host2 sshd[3493594]: Disconnected from invalid user zsolt 23.95.37.90 port 41026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.232.248
country_id: 2017370
description:
Oct 31 05:19:15 host2 sshd[3493702]: Disconnected from invalid user usuario 45.135.232.248 port 46162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Oct 31 05:19:28 host2 sshd[3493923]: Disconnected from invalid user josh 20.74.129.186 port 22950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Oct 31 05:19:58 host2 sshd[3494366]: Disconnected from invalid user owncloud 57.128.173.133 port 52452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-10-31 05:20:05 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:43710: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.126
country_id: 6252001
description:
Oct 31 05:22:36 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.126, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</suM8WhCUNPG6xh+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 05:21:57 host2 sshd[3496574]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.135.232.248
country_id: 2017370
description:
Oct 31 05:21:37 host2 sshd[3496300]: Disconnected from invalid user ali 45.135.232.248 port 42442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-10-31 05:25:34 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (calante) [67.173.58.47]:41716: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-10-31 05:25:42 dovecot_plain authenticator failed for (puble) [65.20.133.4]:50003: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.131
country_id: 1733045
description:
2025-10-31 05:27:35 dovecot_login authenticator failed for ([49.124.142.131]) [49.124.142.131]:33912: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.185
country_id: 290557
description:
Oct 31 05:29:58 host2 sshd[3504495]: Disconnected from invalid user webmaster 20.74.129.185 port 29302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.55.72
country_id: 6252001
description:
Oct 31 05:34:17 host2 sshd[3509213]: Disconnected from invalid user idol 107.174.55.72 port 42040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Oct 31 05:36:14 host2 sshd[3511392]: Disconnected from invalid user hms 107.174.55.72 port 34016 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Oct 31 05:36:54 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vwSqJGlC09XG6xik>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Oct 31 05:38:21 host2 sshd[3513405]: Disconnected from invalid user sammy 177.10.201.7 port 54488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.187
country_id: 290557
description:
Oct 31 05:40:29 host2 sshd[3515662]: Disconnected from invalid user tester 20.74.129.187 port 38289 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.10.201.7
country_id: 3469034
description:
Oct 31 05:41:47 host2 sshd[3516724]: Disconnected from invalid user users 177.10.201.7 port 48664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.187
country_id: 290557
description:
Oct 31 05:41:56 host2 sshd[3516850]: Disconnected from invalid user usuario 20.74.129.187 port 33506 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.48
country_id: 2264397
description:
Oct 31 05:43:32 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8xpkPGlCM6NtadEw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.233.57.93
country_id: 290557
description:
Oct 31 05:43:25 host2 sshd[3518234]: Disconnected from invalid user holiday 20.233.57.93 port 53418 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.48
country_id: 2264397
description:
Oct 31 05:43:30 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.48, lip=66.85.158.91, TLS, session=<x8BBPGlCyc9tadEw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.47
country_id: 2264397
description:
Oct 31 05:43:29 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.47, lip=66.85.158.91, session=<GOAxPGlCteptadEv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.47
country_id: 2264397
description:
Oct 31 05:43:33 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=109.105.209.47, lip=66.85.158.91, session=<Ilx0PGlCQpttadEv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.49
country_id: 2264397
description:
Oct 31 05:43:33 host2 dovecot[1612370]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.49, lip=66.85.158.91, TLS, session=<LFd2PGlC541tadEx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.50
country_id: 2264397
description:
Oct 31 05:43:33 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.209.50, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<KwZ1PGlCTeBtadEy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-10-31 05:44:17 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:48917: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-10-31 05:43:47 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:33973: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.223.25.174
country_id: 6252001
description:
2025-10-31 05:43:58 dovecot_login authenticator failed for 174.sub-75-223-25.myvzw.com [75.223.25.174]:41661: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-10-31 05:44:13 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:54418: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Oct 31 05:44:55 host2 sshd[3520280]: Disconnected from invalid user dan 177.10.201.7 port 41868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.11.89.175
country_id: 3923057
description:
2025-10-31 05:46:49 dovecot_login authenticator failed for host-190-11-89-175.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [190.11.89.175]:49438: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-10-31 05:47:02 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:63615: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-10-31 05:48:26 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (caniny) [73.213.237.28]:41186: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-31 05:51:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noing) [87.103.126.54]:48599: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-10-31 05:53:19 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:35950: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.78.165.192
country_id: 1605651
description:
2025-10-31 05:53:43 dovecot_login authenticator failed for ([110.77.150.25]) [110.78.165.192]:37551: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-10-31 05:55:02 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:53072: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-10-31 05:55:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:41596: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.61.197
country_id: 294640
description:
Oct 31 05:56:22 host2 sshd[3532596]: Disconnected from invalid user javad 63.250.61.197 port 2562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Oct 31 05:56:25 host2 sshd[3532622]: Disconnected from invalid user Saurav 107.174.55.72 port 54848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-10-31 05:57:50 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:38060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-10-31 05:58:09 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:62529: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 63.250.61.197
country_id: 294640
description:
Oct 31 05:59:27 host2 sshd[3535568]: Disconnected from invalid user hong 63.250.61.197 port 10700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.222
country_id: 357994
description:
2025-10-31 06:04:57 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:62241: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-10-31 06:05:08 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:48252: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-10-31 06:07:10 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:55606: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.223.25.174
country_id: 6252001
description:
2025-10-31 06:07:23 dovecot_login authenticator failed for 174.sub-75-223-25.myvzw.com [75.223.25.174]:54479: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.88.209
country_id: 290557
description:
2025-10-31 06:11:39 dovecot_plain authenticator failed for (sycnouss) [87.200.88.209]:59644: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 06:15:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57095: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.85.155.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 66.85.155.91: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-10-31 06:21:47 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:59878: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-10-31 06:22:32 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:60058: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.244.38.224
country_id: 6252001
description:
Oct 31 06:22:41 host2 sshd[3559711]: Disconnected from invalid user ubuntu 38.244.38.224 port 60934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.111.7
country_id: 2921044
description:
Oct 31 06:24:23 host2 sshd[3561325]: Disconnected from invalid user silvia 167.172.111.7 port 57626 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.244.38.224
country_id: 6252001
description:
Oct 31 06:25:19 host2 sshd[3562355]: Disconnected from invalid user source 38.244.38.224 port 41666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-10-31 06:25:18 dovecot_login authenticator failed for ([27.123.112.90]) [27.123.112.90]:57222: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.66.25.166
country_id: 597427
description:
Oct 31 06:25:23 host2 sshd[3562371]: Disconnected from invalid user xu 195.66.25.166 port 38792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-10-31 06:25:01 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:42958: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.125.5
country_id: 1819730
description:
Oct 31 06:25:37 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.125.5, lip=66.85.158.91, session=<pv7n0mlCHEylmn0F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.111.7
country_id: 2921044
description:
Oct 31 06:26:44 host2 sshd[3563761]: Disconnected from invalid user testftp 167.172.111.7 port 55104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Oct 31 06:26:54 host2 sshd[3563865]: Disconnected from invalid user newtranx 34.66.72.251 port 39960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-10-31 06:27:55 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:60099: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Oct 31 06:28:03 host2 sshd[3565153]: Disconnected from invalid user es 34.66.72.251 port 57876 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-10-31 06:28:04 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:53234: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.66.25.166
country_id: 597427
description:
Oct 31 06:27:41 host2 sshd[3564637]: Disconnected from invalid user elena 195.66.25.166 port 52004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.244.38.224
country_id: 6252001
description:
Oct 31 06:27:43 host2 sshd[3564646]: Disconnected from invalid user loongson 38.244.38.224 port 57370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.244.38.224
country_id: 6252001
description:
Oct 31 06:28:57 host2 sshd[3565913]: Disconnected from invalid user smre 38.244.38.224 port 56796 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-10-31 06:29:01 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:48350: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.111.7
country_id: 2921044
description:
Oct 31 06:29:07 host2 sshd[3566232]: Disconnected from invalid user amir 167.172.111.7 port 43734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.66.25.166
country_id: 597427
description:
Oct 31 06:30:07 host2 sshd[3567359]: Disconnected from invalid user bella 195.66.25.166 port 58380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Oct 31 06:30:24 host2 sshd[3567848]: Disconnected from invalid user source 34.66.72.251 port 44708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 06:29:36 host2 sshd[3566664]: Disconnected from invalid user user 62.60.131.157 port 17968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-10-31 06:31:21 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:47122: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-10-31 06:31:01 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:33924: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.165.65.236
country_id: 1819730
description:
Oct 31 06:31:06 host2 sshd[3568599]: Disconnected from invalid user sne 69.165.65.236 port 38698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-10-31 06:31:15 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (untheryge) [73.13.220.220]:37830: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.198.199.79
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 143.198.199.79 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Oct 31 06:31:41 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qaeW6GlCeKBChJl0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.165.65.236
country_id: 1819730
description:
Oct 31 06:34:07 host2 sshd[3571445]: Disconnected from invalid user user2 69.165.65.236 port 43352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.165.65.236
country_id: 1819730
description:
Oct 31 06:35:34 host2 sshd[3573014]: Disconnected from invalid user guest 69.165.65.236 port 45160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-10-31 06:35:56 dovecot_login authenticator failed for (49.207.9.39.actcorp.in) [49.207.9.39]:57548: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.127
country_id: 99237
description:
2025-10-31 06:36:22 dovecot_login authenticator failed for ([65.20.251.127]) [65.20.251.127]:36061: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.86.212.108
country_id: 6252001
description:
2025-10-31 06:35:44 dovecot_login authenticator failed for ([96.86.212.108]) [96.86.212.108]:57552: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-10-31 06:35:57 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:33346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Oct 31 06:41:06 host2 pure-ftpd[3578966]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.145.159.15
country_id: 6252001
description:
[2025-10-31 06:41:07 +0530] info [cpaneld] 132.145.159.15 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-10-31 06:44:25 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (gnidifon) [68.82.141.145]:39266: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.60
country_id: 6252001
description:
Oct 31 06:45:22 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<uY6MGWpCnd7N0h88>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.39.153.63
country_id: 6252001
description:
2025-10-31 06:46:00 dovecot_plain authenticator failed for c-73-39-153-63.hsd1.dc.comcast.net (subgly) [73.39.153.63]:43771: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 06:46:36 host2 sshd[3585430]: Disconnected from invalid user user 62.60.131.157 port 53006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-10-31 06:49:56 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (hasing) [76.145.10.140]:39092: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 06:50:53 host2 sshd[3589669]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.245.196
country_id: 1605651
description:
Oct 31 06:52:06 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.245.196, lip=66.85.158.92, session=<QOKZMWpCWIGYIPXE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.163
country_id: 6252001
description:
Oct 31 06:52:10 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.163, lip=66.85.158.91, TLS: Connection closed, session=<oYDTMWpCB5fDuEyj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.162
country_id: 6252001
description:
Oct 31 06:51:59 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Coo2MWpC84HDuEyi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.39.153.63
country_id: 6252001
description:
2025-10-31 06:55:11 dovecot_plain authenticator failed for c-73-39-153-63.hsd1.dc.comcast.net (dinluxter) [73.39.153.63]:60955: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 06:57:21 host2 sshd[3597187]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.201
country_id: 6252001
description:
Oct 31 06:56:56 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.201, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JQ/mQmpCaajDuEzJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.206
country_id: 6252001
description:
Oct 31 06:56:59 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.206, lip=66.85.158.91, TLS: Connection closed, session=<+RcVQ2pC7a/DuEzO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.142.196
country_id: 2077456
description:
2025-10-31 06:57:42 dovecot_login authenticator failed for (115-129-142-196.tpgi.com.au) [115.129.142.196]:56702: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.245.196
country_id: 1605651
description:
Oct 31 06:57:51 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.245.196, lip=66.85.158.91, session=<WV8wRmpCQs+YIPXE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-10-31 06:57:51 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:38778: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.131.245
country_id: 1819730
description:
Oct 31 06:57:57 host2 pure-ftpd[3597853]: (?@152.32.131.245) [INFO] New connection from 152.32.131.245


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 152.32.131.245
country_id: 1819730
description:
Oct 31 06:58:45 host2 pure-ftpd[3598946]: (?@152.32.131.245) [INFO] New connection from 152.32.131.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.131.245
country_id: 1819730
description:
Oct 31 06:58:45 host2 pure-ftpd[3598943]: (?@152.32.131.245) [INFO] New connection from 152.32.131.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-10-31 07:02:20 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:55952: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Oct 31 07:02:26 host2 sshd[3602957]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 62593


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.204.151.223
country_id: 1210997
description:
2025-10-31 07:02:35 dovecot_login authenticator failed for ([116.204.148.28]) [116.204.151.223]:57716: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Oct 31 07:02:47 host2 sshd[3603299]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 49557


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-10-31 07:05:37 dovecot_plain authenticator failed for (monizen) [85.29.149.211]:56132: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-10-31 07:05:57 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:60500: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-10-31 07:05:41 dovecot_login authenticator failed for ([49.124.153.40]) [49.124.153.40]:48778: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Oct 31 07:06:44 host2 sshd[3607936]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57912


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.91
country_id: 6252001
description:
Oct 31 07:07:55 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.106.91, lip=66.85.158.91, session=<gMcuampCbrsUQGpb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-10-31 07:08:50 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:58443: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.60
country_id: 1733045
description:
2025-10-31 07:09:04 dovecot_login authenticator failed for ([49.124.151.60]) [49.124.151.60]:36868: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.145.159.15
country_id: 6252001
description:
Oct 31 07:09:43 host2 pure-ftpd[3610937]: (?@132.145.159.15) [INFO] New connection from 132.145.159.15


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.201.169
country_id: 6252001
description:
Oct 31 07:11:06 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.118.201.169, lip=66.85.158.92, session=<OKKVdWpCxIcUdsmp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-10-31 07:12:33 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:54482: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Oct 31 07:11:42 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<vxa0d2pCxoqLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-10-31 07:13:57 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:41548: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2025-10-31 07:14:24 dovecot_login authenticator failed for (193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:53173: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.93.18.147
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 142.93.18.147 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.208
country_id: 798544
description:
Oct 31 07:16:03 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=178.216.27.208, lip=66.85.158.91, TLS, session=<JnYGhmpCbMWy2BvQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.195.44.129
country_id: 3469034
description:
Oct 31 07:15:39 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training@v-deploy.com>, method=PLAIN, rip=168.195.44.129, lip=66.85.158.91, TLS, session=<Xl2LhGpCHNKowyyB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-10-31 07:17:02 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:48044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.73.160.131
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 216.73.160.131 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-10-31 07:26:25 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53020: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.45.187.68
country_id: 3865483
description:
2025-10-31 07:26:40 dovecot_login authenticator failed for host68.200-45-187.telecom.net.ar [200.45.187.68]:37328: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.236
country_id: 2635167
description:
Oct 31 07:28:13 host2 pure-ftpd[3633932]: (?@185.247.137.236) [INFO] New connection from 185.247.137.236


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Oct 31 07:33:06 host2 sshd[3640069]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 52148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-10-31 07:39:43 dovecot_plain authenticator failed for (wrisodium) [65.20.184.80]:45436: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-10-31 07:40:29 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (chrishic) [71.230.228.16]:46734: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.245.102.54
country_id: 3996063
description:
2025-10-31 07:40:50 dovecot_login authenticator failed for 148-245-102-54.static.axtel.net [148.245.102.54]:42145: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-10-31 07:41:25 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:60839: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-10-31 07:42:28 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:60002: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-31 07:42:46 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:54440: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-10-31 07:44:05 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:48958: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2025-10-31 07:44:19 dovecot_login authenticator failed for ([49.124.151.53]) [49.124.151.53]:60758: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-10-31 07:44:18 dovecot_login authenticator failed for ([61.0.236.99]) [182.72.143.2]:50122: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-10-31 07:46:01 dovecot_plain authenticator failed for (betak) [90.160.139.163]:58383: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
country_id: 290557
description:
2025-10-31 07:47:55 dovecot_plain authenticator failed for (unded) [91.72.148.106]:56432: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.69
country_id: 2921044
description:
Oct 31 07:49:05 host2 sshd[3658397]: Disconnected from invalid user rke 46.101.206.69 port 55834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-10-31 07:49:57 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:58944: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.11.69
country_id: 6252001
description:
Oct 31 07:50:35 host2 sshd[3659974]: Disconnected from invalid user ripley 165.22.11.69 port 49334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-10-31 07:52:04 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:48053: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.91.39.115
country_id: 1522867
description:
2025-10-31 07:52:38 dovecot_login authenticator failed for 178.91.39.115.dynamic.telecom.kz [178.91.39.115]:60103: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.11.69
country_id: 6252001
description:
Oct 31 07:53:21 host2 sshd[3662757]: Disconnected from invalid user ttstest 165.22.11.69 port 47794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-10-31 07:54:05 dovecot_plain authenticator failed for (perpol) [65.20.149.93]:52220: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.21.115
country_id: 1269750
description:
Oct 31 07:54:23 host2 sshd[3663838]: Disconnected from invalid user denis 139.59.21.115 port 34006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.11.69
country_id: 6252001
description:
Oct 31 07:54:32 host2 sshd[3664365]: Disconnected from invalid user webserver 165.22.11.69 port 45914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-10-31 07:55:12 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:52082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.69
country_id: 2921044
description:
Oct 31 07:55:24 host2 sshd[3665246]: Disconnected from invalid user gialvarez 46.101.206.69 port 55848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2025-10-31 07:55:44 dovecot_login authenticator failed for host-188-11-17-169.business.telecomitalia.it [188.11.17.169]:52134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.155.76
country_id: 294640
description:
2025-10-31 07:56:40 dovecot_login authenticator failed for ([80.250.155.76]) [80.250.155.76]:46332: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-10-31 07:56:49 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:38978: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.11.69
country_id: 6252001
description:
Oct 31 07:58:01 host2 sshd[3667937]: Disconnected from invalid user test 165.22.11.69 port 41186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-10-31 07:57:28 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:52202: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-10-31 07:59:26 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:55779: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Oct 31 07:59:51 host2 sshd[3669748]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56421


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-10-31 07:59:58 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:49448: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.128
country_id: 6252001
description:
Oct 31 08:04:51 host2 pure-ftpd[3675493]: (?@66.132.153.128) [INFO] New connection from 66.132.153.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-10-31 08:05:47 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (gistolles) [66.177.30.53]:60250: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-10-31 08:08:45 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:39574: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.97.6
country_id: 1269750
description:
2025-10-31 08:08:57 dovecot_login authenticator failed for (nsg-corporate-6.97.185.122.airtel.in) [122.185.97.6]:46494: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.45
country_id: 2635167
description:
Oct 31 08:13:13 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.45, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aoSwU2tCONsjy9Mt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:15:06 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FD5vWmtC3qoDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-10-31 08:16:21 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:54603: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:16:30 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GWVwX2tCKrQDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.5.158
country_id: 290557
description:
2025-10-31 08:16:35 dovecot_login authenticator failed for ([5.31.5.158]) [5.31.5.158]:58773: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:17:24 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iqOlYmtCgpQDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:18:25 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<N2VNZmtCTuIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:19:52 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<uwJ4a2tC5KkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.45
country_id: 2635167
description:
Oct 31 08:20:44 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.45, lip=66.85.158.91, TLS, session=<qnaRbmtChPIjy9Mt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:20:44 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<AhaYbmtCvOkDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.92
country_id: 1269750
description:
2025-10-31 08:21:38 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.92]:54098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-10-31 08:22:02 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:11084: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:21:26 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<t+UScWtCNuYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:22:20 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aoJOdGtCkJADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.165
country_id: 2077456
description:
2025-10-31 08:23:28 dovecot_login authenticator failed for (ADMIN) [179.61.228.165]:31370: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:23:35 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<s+LAeGtCPMADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Oct 31 08:24:27 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<Zb/ee2tCaMgDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-10-31 08:24:56 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (diosm) [24.23.125.83]:39608: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 08:25:30 host2 sshd[3697240]: Disconnected from invalid user user 62.60.131.157 port 37785 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 08:26:27 host2 sshd[3698267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-10-31 08:28:07 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:47968: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-10-31 08:28:40 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:59569: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-10-31 08:29:12 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:12903: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-10-31 08:29:26 dovecot_login authenticator failed for ([2.55.70.26]) [2.55.70.26]:33176: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Oct 31 08:30:41 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<veIrkmtCmrEs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.25.199.200
country_id: 2464461
description:
2025-10-31 08:30:47 dovecot_login authenticator failed for ([197.25.199.200]) [197.25.199.200]:43687: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-10-31 08:30:11 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:59174: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 08:32:53 host2 sshd[3705105]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-10-31 08:32:51 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:47568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-10-31 08:33:31 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:54340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-10-31 08:33:49 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (lards) [73.13.220.220]:50554: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-10-31 08:34:20 dovecot_plain authenticator failed for (tomencaria) [65.20.250.163]:36372: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.212
country_id: 6252001
description:
Oct 31 08:40:58 host2 pure-ftpd[3713539]: (?@205.210.31.212) [INFO] New connection from 205.210.31.212


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-10-31 08:46:41 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:55430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Oct 31 08:46:58 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.238, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JS9tzGtC5dzG6xju>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-10-31 08:46:28 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:59302: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-10-31 08:46:32 dovecot_plain authenticator failed for (oless) [65.20.129.67]:60605: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Oct 31 08:48:01 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<gZkt0GtCNo0s3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-10-31 08:49:47 dovecot_plain authenticator failed for (relitingly) [84.238.92.245]:60608: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-10-31 08:49:53 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (narited) [5.185.198.73]:58716: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-10-31 08:50:30 dovecot_plain authenticator failed for (ovenzory) [46.8.245.34]:56896: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-10-31 08:50:31 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:45189: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-10-31 08:50:17 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:55810: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.64.26
country_id: 1861060
description:
2025-10-31 09:00:17 dovecot_login authenticator failed for 133.232.64.26.static.zoot.jp [133.232.64.26]:40406: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-10-31 09:06:02 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:53072: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-10-31 09:06:26 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:40396: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.17
country_id: 1733045
description:
2025-10-31 09:08:18 dovecot_login authenticator failed for ([49.124.153.17]) [49.124.153.17]:50388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-10-31 09:08:58 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:41462: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-10-31 09:11:02 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:35811: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-10-31 09:10:09 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:39975: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-10-31 09:10:20 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:50386: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.144
country_id: 1694008
description:
2025-10-31 09:11:23 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.144]:42344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Oct 31 09:14:20 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<uds/LmxCbp82rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.254.134
country_id: 1269750
description:
2025-10-31 09:18:17 dovecot_login authenticator failed for ([125.19.165.90]) [125.20.254.134]:42656: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-10-31 09:18:32 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:55486: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-10-31 09:24:04 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:56562: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.137.145
country_id: 294640
description:
2025-10-31 09:23:38 dovecot_login authenticator failed for bzq-109-67-137-145.red.bezeqint.net [109.67.137.145]:38004: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.130.210
country_id: 2661886
description:
2025-10-31 09:25:01 dovecot_login authenticator failed for 95.209.130.210.bredband.tre.se [95.209.130.210]:53374: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-10-31 09:25:20 dovecot_login authenticator failed for ([152.52.169.97]) [122.186.60.142]:38404: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-10-31 09:26:15 dovecot_plain authenticator failed for (koftiene) [62.74.225.186]:36679: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Oct 31 09:27:25 host2 sshd[3767032]: Disconnected from invalid user registry 51.83.46.40 port 37202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.46.40
country_id: 3017382
description:
Oct 31 09:28:35 host2 sshd[3768240]: Disconnected from invalid user atomic 51.83.46.40 port 42088 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.68.119.62
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 189.68.119.62 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 219.91.178.230
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 219.91.178.230 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.52.122.105
country_id: 1327865
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.52.122.105 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.91.29.125
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 50.91.29.125 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.146.21
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 14.191.146.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.75.201.196
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 116.75.201.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Oct 31 09:30:45 host2 sshd[3770941]: Disconnected from invalid user donut 51.83.46.40 port 53918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-31 09:32:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dater) [87.103.126.54]:60484: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.26
country_id: 6252001
description:
Oct 31 09:34:01 host2 dovecot[1612370]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.26, lip=66.85.158.91, TLS, session=<BHyqdGxC7OrN0h8a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.56.26
country_id: 1269750
description:
2025-10-31 09:35:24 dovecot_login authenticator failed for (nsg-corporate-26.56.187.122.airtel.in) [122.187.56.26]:49342: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-10-31 09:35:27 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:35085: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-10-31 09:35:38 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:50502: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-10-31 09:35:46 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:57865: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Oct 31 09:36:49 host2 sshd[3777284]: Disconnected from invalid user rc 103.179.56.78 port 52958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-10-31 09:38:41 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:6266: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-10-31 09:40:54 dovecot_plain authenticator failed for (tuditic) [65.20.160.107]:48290: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 09:41:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61163: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.24
country_id: 3017382
description:
Oct 31 10:00:49 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Rolc1GxCTcpbxJgY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Oct 31 10:00:49 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.118, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IIxc1GxCd95bxJh2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Oct 31 10:00:49 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=89.248.167.131, lip=66.85.158.92, TLS handshaking: Connection closed, session=<o45c1GxCqqZZ+KeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.152.17
country_id: 1819730
description:
Oct 31 10:00:49 host2 dovecot[1612370]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.152.17, lip=66.85.158.92, session=<1Ylc1GxC7k2lmpgR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 10:02:06 host2 sshd[3788971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Oct 31 10:02:19 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<mCjf2WxCzpKnXpIx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.78
country_id: 1643084
description:
Oct 31 10:03:58 host2 sshd[3791759]: Disconnected from invalid user max 103.179.56.78 port 34648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-10-31 10:07:04 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:45402: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-10-31 10:06:58 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:54897: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 10:08:33 host2 sshd[3797061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Oct 31 10:07:53 host2 sshd[3796220]: Disconnected from invalid user admon 103.179.56.78 port 55350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Oct 31 10:09:53 host2 sshd[3798468]: Disconnected from invalid user andre 103.179.56.78 port 54422 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.43
country_id: 2635167
description:
Oct 31 10:14:19 host2 dovecot[1612370]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.43, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<o7DQBG1CTP0jy9Ir>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.236.67.141
country_id: 6252001
description:
2025-10-31 10:16:05 dovecot_login authenticator failed for user-24-236-67-141.knology.net [24.236.67.141]:34608: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.117.76
country_id: 2510769
description:
2025-10-31 10:18:40 dovecot_login authenticator failed for (76.pool90-160-117.dynamic.orange.es) [90.160.117.76]:53854: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.43
country_id: 2635167
description:
Oct 31 10:21:14 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.43, lip=66.85.158.92, TLS, session=<fIaBHW1C9vsjy9Ir>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.239.77.168
country_id: 6252001
description:
Oct 31 10:20:27 host2 sshd[3813483]: User bostonlanka from 35.239.77.168 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.100.212
country_id: 6252001
description:
Oct 31 10:22:05 host2 dovecot[3810358]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.100.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HXOWIG1CbotK62TU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-10-31 10:22:30 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:42825: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-10-31 10:22:53 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:65237: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-10-31 10:24:20 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:50268: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-10-31 10:24:30 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:35682: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.185
country_id: 2186224
description:
2025-10-31 10:24:35 dovecot_login authenticator failed for ([121.73.169.185]) [121.73.169.185]:37730: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-10-31 10:24:42 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:37118: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Oct 31 10:25:19 host2 dovecot[3810358]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS, session=<jXMoLG1CfLZo7NEL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-10-31 10:27:34 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:43766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.31
country_id: 6252001
description:
Oct 31 10:32:22 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.31, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9hddRW1CMd3N0h8f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-10-31 10:41:35 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:57896: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Oct 31 10:44:55 host2 dovecot[3810358]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<EXY3cm1CApwDWgzA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Oct 31 10:48:22 host2 sshd[3842055]: Disconnected from invalid user bruno 202.157.177.161 port 45294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Oct 31 10:51:22 host2 sshd[3845043]: Disconnected from invalid user fs 202.157.177.161 port 49512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.216
country_id: 6252001
description:
Oct 31 10:52:26 host2 dovecot[3810358]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.124.216, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d8AXjW1CSOUNWXzY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Oct 31 10:53:06 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<eS56j21CtOe58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-10-31 10:54:00 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:58068: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.25.199.200
country_id: 2464461
description:
2025-10-31 10:54:35 dovecot_login authenticator failed for ([197.25.199.200]) [197.25.199.200]:40317: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Oct 31 10:54:37 host2 sshd[3848494]: Disconnected from invalid user user 202.157.177.161 port 53736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-31 10:55:38 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (bultitn) [87.103.126.54]:61159: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Oct 31 10:55:56 host2 sshd[3849955]: Disconnected from invalid user rex 38.248.12.102 port 33862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-10-31 10:56:42 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12061: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.12.204.239
country_id: 2960313
description:
Oct 31 10:56:47 host2 sshd[3850695]: User bostonlanka from 185.12.204.239 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-10-31 10:57:01 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:38288: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.248.12.102
country_id: 6252001
description:
Oct 31 10:59:15 host2 sshd[3853153]: Disconnected from invalid user server 38.248.12.102 port 49252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Oct 31 10:58:49 host2 sshd[3852595]: Disconnected from invalid user sio 202.157.177.161 port 60024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Oct 31 11:00:25 host2 sshd[3854375]: Disconnected from invalid user ts 38.248.12.102 port 47666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Oct 31 11:01:36 host2 sshd[3855586]: Disconnected from invalid user minecraft 38.248.12.102 port 60766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-10-31 11:02:31 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:38602: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-10-31 11:02:48 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:48885: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-10-31 11:02:51 dovecot_plain authenticator failed for (proph) [41.248.243.181]:54532: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.65.138
country_id: 1269750
description:
2025-10-31 11:04:01 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:43010: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-10-31 11:04:26 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:36532: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Oct 31 11:04:40 host2 sshd[3858837]: Disconnected from invalid user developer 139.59.66.39 port 44754 [preauth]


