# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Oct 31 11:06:03 host2 sshd[3860431]: Disconnected from invalid user reseller 139.59.66.39 port 53916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-10-31 11:06:39 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:60679: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-10-31 11:09:47 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:55159: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Oct 31 11:09:24 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<FbPMyW1Cvo258uIh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Oct 31 11:11:33 host2 sshd[3865876]: Disconnected from invalid user rea 139.59.66.39 port 33390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-10-31 11:13:12 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:37248: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.37
country_id: 6252001
description:
Oct 31 11:14:47 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.37, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<l1YD3W1CrsvN0h8l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Oct 31 11:16:05 host2 sshd[3870366]: Disconnected from invalid user emmanuel 50.84.211.204 port 42218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-10-31 11:17:12 dovecot_plain authenticator failed for (tatinalis) [102.53.15.17]:51566: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.103.89
country_id: 1861060
description:
2025-10-31 11:18:06 dovecot_login authenticator failed for (ADMIN) [149.88.103.89]:34572: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Oct 31 11:17:28 host2 sshd[3871701]: Disconnected from invalid user daghem 50.84.211.204 port 47644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Oct 31 11:18:50 host2 sshd[3872839]: Disconnected from invalid user vincephoenix 50.84.211.204 port 53072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-10-31 11:21:52 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (partablith) [73.137.7.97]:52476: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-10-31 11:24:53 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:42904: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-10-31 11:27:56 dovecot_plain authenticator failed for (shabled) [65.20.155.223]:35039: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-10-31 11:29:15 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (roment) [76.31.164.124]:60724: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-10-31 11:29:48 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:43166: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.69.224
country_id: 294640
description:
2025-10-31 11:30:15 dovecot_login authenticator failed for (31-154-69-224.orange.net.il) [2.55.69.224]:56848: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-10-31 11:32:00 dovecot_plain authenticator failed for (plover) [5.11.140.219]:33980: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.112
country_id: 6252001
description:
Oct 31 11:31:42 host2 dovecot[3810358]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.112, lip=66.85.158.92, TLS: Connection closed, session=<iA6NGW5CtsDHLZpw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Oct 31 11:33:11 host2 sshd[3887977]: Disconnected from invalid user cat 24.199.117.9 port 51512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-10-31 11:33:38 dovecot_login authenticator failed for (zsvx5v4kI) [185.196.8.151]:55647: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-10-31 11:34:00 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:56163: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-10-31 11:34:16 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:34462: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-10-31 11:34:24 dovecot_login authenticator failed for (mMqKC3eB) [185.196.8.151]:52688: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-10-31 11:35:32 dovecot_login authenticator failed for (qUiZLX) [185.196.8.151]:55469: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
country_id: 290557
description:
2025-10-31 11:36:40 dovecot_plain authenticator failed for (grack) [91.72.148.106]:43874: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.117.9
country_id: 6252001
description:
Oct 31 11:36:26 host2 sshd[3891700]: Disconnected from invalid user ct 24.199.117.9 port 52298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-10-31 11:36:37 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:41806: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.20
country_id: 294640
description:
2025-10-31 11:36:35 dovecot_plain authenticator failed for (bhononess) [2.55.84.20]:48942: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-10-31 11:36:59 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:52293: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 11:37:34 host2 sshd[3892856]: Disconnected from invalid user user 62.60.131.157 port 5313 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Oct 31 11:37:42 host2 sshd[3893013]: Disconnected from invalid user artur 24.199.117.9 port 58086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Oct 31 11:39:57 host2 sshd[3895499]: Disconnected from invalid user dk 103.14.33.177 port 59730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-10-31 11:42:41 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:41262: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.28
country_id: 1733045
description:
2025-10-31 11:43:04 dovecot_login authenticator failed for ([49.124.153.28]) [49.124.153.28]:54424: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-10-31 11:44:48 dovecot_login authenticator failed for ([176.30.212.99]) [176.30.212.99]:59672: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-10-31 11:45:06 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:35572: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-10-31 11:45:40 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:46907: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.18.243
country_id: 6252001
description:
2025-10-31 11:45:49 dovecot_login authenticator failed for (209-141-18-243.sfn.uct-usa.com) [209.141.18.243]:46074: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.163
country_id: 2328926
description:
2025-10-31 11:46:44 dovecot_login authenticator failed for (ADMIN) [146.70.65.163]:52822: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-10-31 11:47:58 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:53044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.126
country_id: 294640
description:
2025-10-31 11:48:13 dovecot_plain authenticator failed for (coasm) [109.226.14.126]:38522: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.14.33.177
country_id: 1880251
description:
Oct 31 11:47:32 host2 sshd[3904614]: Disconnected from invalid user salma 103.14.33.177 port 51568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.213
country_id: 1733045
description:
2025-10-31 11:48:20 dovecot_login authenticator failed for ([49.124.152.213]) [49.124.152.213]:57620: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Oct 31 11:50:11 host2 sshd[3907462]: Disconnected from invalid user rafael 103.14.33.177 port 35154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Oct 31 11:51:44 host2 sshd[3909114]: Disconnected from invalid user masud1 103.14.33.177 port 52948 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.87
country_id: 6252001
description:
Oct 31 11:54:25 host2 pure-ftpd[3912306]: (?@205.210.31.87) [INFO] New connection from 205.210.31.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-10-31 11:55:56 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (arcally) [73.183.74.177]:41704: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.82
country_id: 6252001
description:
Oct 31 11:56:04 host2 dovecot[3810358]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.82, lip=66.85.158.91, session=<XgC0cG5CqqYUQGlS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-10-31 11:57:02 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (indalnumon) [98.192.114.251]:55405: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-10-31 11:57:05 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (bactic) [68.40.189.43]:35490: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.242.174
country_id: 2750405
description:
Oct 31 11:57:57 host2 pure-ftpd[3916135]: (?@178.128.242.174) [INFO] New connection from 178.128.242.174


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Oct 31 12:03:00 host2 pure-ftpd[3921649]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Oct 31 12:04:39 host2 sshd[3923842]: Disconnected from invalid user etherpad 103.241.45.120 port 41014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.35.75.39
country_id: 2921044
description:
Oct 31 12:05:13 host2 sshd[3924593]: Disconnected from invalid user ketan 161.35.75.39 port 43832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.35.75.39
country_id: 2921044
description:
Oct 31 12:07:31 host2 sshd[3927145]: Disconnected from invalid user keshav 161.35.75.39 port 37832 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.35.75.39
country_id: 2921044
description:
Oct 31 12:08:45 host2 sshd[3928468]: Disconnected from invalid user 4 161.35.75.39 port 38082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Oct 31 12:10:31 host2 sshd[3930406]: Disconnected from invalid user alina 103.241.45.120 port 45426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.91
country_id: 1668284
description:
2025-10-31 12:11:05 dovecot_login authenticator failed for (ADMIN) [173.244.49.91]:23692: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.235.164
country_id: 6252001
description:
Oct 31 12:11:14 host2 dovecot[3810358]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=20.46.235.164, lip=66.85.158.92, session=<HULspm5CPt4ULuuk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Oct 31 12:10:19 host2 sshd[3930316]: Disconnected from invalid user 4 117.216.211.19 port 47674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-10-31 12:12:09 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:60343: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.96.180.174
country_id: 1819730
description:
Oct 31 12:11:39 host2 sshd[3931748]: Disconnected from invalid user tiger 34.96.180.174 port 44764 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Oct 31 12:11:47 host2 sshd[3931795]: Disconnected from invalid user keshav 117.216.211.19 port 48832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-10-31 12:12:57 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:56806: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.96.180.174
country_id: 1819730
description:
Oct 31 12:13:05 host2 sshd[3933097]: Disconnected from invalid user tecnet 34.96.180.174 port 50640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.35.75.39
country_id: 2921044
description:
Oct 31 12:13:16 host2 sshd[3933339]: Disconnected from invalid user wordpress 161.35.75.39 port 34208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-10-31 12:15:09 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:58708: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.60
country_id: 1733045
description:
2025-10-31 12:15:33 dovecot_login authenticator failed for ([49.124.151.60]) [49.124.151.60]:50784: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-31 12:21:25 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:36304: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-10-31 12:21:46 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:43106: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.59.142
country_id: 2921044
description:
Oct 31 12:22:50 host2 dovecot[3810358]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.193.59.142, lip=66.85.158.91, session=<4IRi0G5CoLt2wTuO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.193.59.142
country_id: 2921044
description:
Oct 31 12:22:51 host2 dovecot[3810358]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.59.142, lip=66.85.158.91, TLS, session=<aPxu0G5Ckrx2wTuO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2025-10-31 12:23:40 dovecot_login authenticator failed for ([49.124.153.41]) [49.124.153.41]:33844: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-10-31 12:24:08 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:56752: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2025-10-31 12:26:18 dovecot_login authenticator failed for ([49.124.151.69]) [49.124.151.69]:60964: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-10-31 12:27:02 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:39006: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Oct 31 12:29:50 host2 dovecot[3810358]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<7EN06W5CHOoD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-10-31 12:30:52 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:52485: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2025-10-31 12:31:03 dovecot_login authenticator failed for ([49.125.201.78]) [49.125.201.78]:34876: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.167
country_id: 6252001
description:
2025-10-31 12:32:36 dovecot_login authenticator failed for (ADMIN) [212.32.50.167]:53510: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-10-31 12:35:05 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (nonmon) [50.74.136.134]:41728: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-10-31 12:36:50 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:43058: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-10-31 12:37:10 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:36914: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.122.170
country_id: 2661886
description:
2025-10-31 12:38:16 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:41744: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.9
country_id: 2186224
description:
2025-10-31 12:38:26 dovecot_login authenticator failed for ([121.73.168.9]) [121.73.168.9]:39238: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-10-31 12:41:18 dovecot_plain authenticator failed for (nocesion) [12.150.243.22]:34958: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 12:47:56 host2 sshd[3970744]: Disconnected from invalid user user 2.57.121.25 port 27662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-10-31 12:50:32 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:54486: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-10-31 12:50:53 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:47072: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.33
country_id: 6252001
description:
Oct 31 12:50:56 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.33, lip=66.85.158.92, session=<EgDiNG9CKueTuYQh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.29
country_id: 2510769
description:
2025-10-31 12:51:46 dovecot_login authenticator failed for (ADMIN) [212.102.49.29]:6149: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-10-31 12:55:44 dovecot_login authenticator failed for (nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:33284: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2025-10-31 12:56:12 dovecot_login authenticator failed for (abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:38641: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-10-31 12:59:18 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (sumats) [196.47.172.253]:42447: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-10-31 13:00:17 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:63025: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-10-31 13:00:26 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (fletrapsy) [5.185.233.251]:43178: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.20
country_id: 1733045
description:
2025-10-31 13:00:38 dovecot_login authenticator failed for ([49.124.153.20]) [49.124.153.20]:51832: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-10-31 13:01:53 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:54898: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-10-31 13:02:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:51962: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.196
country_id: 1733045
description:
2025-10-31 13:05:00 dovecot_login authenticator failed for ([49.124.159.196]) [49.124.159.196]:41074: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-10-31 13:05:30 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:63836: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Oct 31 13:06:51 host2 sshd[3991611]: Disconnected from invalid user report 185.158.23.150 port 54690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 13:07:22 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59912: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2025-10-31 13:08:03 dovecot_login authenticator failed for ([49.124.152.208]) [49.124.152.208]:50296: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Oct 31 13:09:07 host2 sshd[3993690]: Disconnected from invalid user tom 185.158.23.150 port 45616 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Oct 31 13:10:39 host2 sshd[3995216]: Disconnected from invalid user mike 185.158.23.150 port 22328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-10-31 13:11:59 dovecot_plain authenticator failed for (salsionic) [24.105.248.218]:45242: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-10-31 13:21:27 dovecot_plain authenticator failed for (ophal) [65.20.174.63]:45246: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-10-31 13:22:14 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:52356: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:23:32 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<iW53qW9C3sUDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 13:23:28 host2 sshd[4008538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:24:35 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<a885rW9CqNoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:25:28 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<2eFrsG9CFOgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:26:21 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<ryKLs29CTIYDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 13:26:56 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57706: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:27:28 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<jgaIt29CdKEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:28:18 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<XkWIum9CcMADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.23.246
country_id: 895949
description:
2025-10-31 13:28:48 dovecot_login authenticator failed for ([41.60.23.246]) [41.60.23.246]:57242: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.102
country_id: 1269750
description:
2025-10-31 13:29:03 dovecot_login authenticator failed for ([125.19.84.9]) [122.184.123.102]:47906: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:29:08 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<eIWGvW9CQOADg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:29:52 host2 dovecot[3961047]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<NMgjwG9CxpgDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:30:41 host2 dovecot[3961047]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<M/wNw29CjIMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:31:21 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<p/FpxW9CWtMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Oct 31 13:31:26 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, TLS, session=<04/DxW9CDuM2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-10-31 13:31:30 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:42626: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-10-31 13:31:44 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:37928: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Oct 31 13:32:07 host2 dovecot[3961047]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<6g4xyG9COroDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-10-31 13:33:54 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:35332: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.75
country_id: 783754
description:
2025-10-31 13:34:14 dovecot_login authenticator failed for (ADMIN) [31.171.154.75]:47012: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.215
country_id: 1269750
description:
2025-10-31 13:34:14 dovecot_login authenticator failed for (nsg-corporate-215.230.187.122.airtel.in) [122.187.230.215]:47661: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-10-31 13:37:57 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:47694: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.102
country_id: 1269750
description:
2025-10-31 13:38:19 dovecot_login authenticator failed for ([128.185.241.177]) [182.95.54.102]:54412: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-10-31 13:39:58 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:43731: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-10-31 13:40:16 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:47907: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-10-31 13:43:08 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:50248: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-10-31 13:43:21 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:54122: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-10-31 13:43:49 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:54912: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.70
country_id: 1269750
description:
2025-10-31 13:44:09 dovecot_login authenticator failed for ([152.52.58.41]) [122.187.172.70]:33766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-10-31 13:46:10 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45366: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-10-31 13:46:25 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:34544: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Oct 31 13:47:52 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<La6BAHBCCNJChJmE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-10-31 13:47:53 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:59186: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-10-31 13:48:05 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:49788: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.13
country_id: 6252001
description:
Oct 31 13:51:26 host2 pure-ftpd[4038382]: (?@172.105.128.13) [INFO] New connection from 172.105.128.13


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 13:52:38 host2 sshd[4039538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.190.68
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 209.50.190.68 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-10-31 13:55:09 dovecot_plain authenticator failed for (satripors) [102.53.15.18]:35410: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.243
country_id: 798544
description:
2025-10-31 13:56:35 dovecot_login authenticator failed for (ADMIN) [138.199.59.243]:37812: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Oct 31 14:01:44 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ALAXMnBCPKlChJmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.45
country_id: 298795
description:
2025-10-31 14:02:04 dovecot_login authenticator failed for ([188.59.178.45]) [188.59.178.45]:39632: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-10-31 14:01:19 dovecot_plain authenticator failed for (uniek) [12.150.243.22]:16052: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-10-31 14:02:14 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:37318: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Oct 31 14:05:58 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<2eJCQXBCnNBChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Oct 31 14:06:08 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P0TOQXBCsqNChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.62
country_id: 1269750
description:
2025-10-31 14:07:25 dovecot_login authenticator failed for (nsg-corporate-62.116.187.122.airtel.in) [122.187.116.62]:38388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-31 14:08:15 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:40316: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-10-31 14:10:12 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:47956: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2025-10-31 14:10:27 dovecot_login authenticator failed for ([59.145.171.168]) [182.78.82.194]:37076: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.169
country_id: 6252001
description:
Oct 31 14:14:21 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.169, lip=66.85.158.91, session=</l4yX3BC7vrG6xip>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-10-31 14:16:03 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:57977: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-10-31 14:16:16 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:51988: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-10-31 14:16:43 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:44116: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.54.246
country_id: 3865483
description:
2025-10-31 14:17:00 dovecot_login authenticator failed for ([170.83.54.246]) [170.83.54.246]:59109: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
country_id: 1269750
description:
2025-10-31 14:18:45 dovecot_login authenticator failed for (abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:56550: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.126.88
country_id: 294640
description:
2025-10-31 14:18:30 dovecot_login authenticator failed for (31-154-126-88.orange.net.il) [2.55.126.88]:48448: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-10-31 14:20:18 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (moeotabess) [73.68.220.15]:52178: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.128
country_id: 6251999
description:
2025-10-31 14:21:43 dovecot_login authenticator failed for (ADMIN) [212.32.48.128]:56884: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 14:21:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:63504: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-10-31 14:21:24 dovecot_login authenticator failed for ([136.228.168.12]) [136.228.168.12]:60887: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 14:25:55 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64045: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 14:27:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:55149: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-31 14:28:05 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:46205: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 14:28:00 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:54520: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-10-31 14:28:25 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:44130: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-10-31 14:29:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64339: 535 Incorrect authentication data (set_id=testing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 14:29:40 host2 sshd[4082118]: Disconnected from invalid user user 2.57.121.25 port 44192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-10-31 14:30:11 dovecot_plain authenticator failed for (gousemake) [102.53.15.56]:41148: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Oct 31 14:30:42 host2 sshd[4083475]: Disconnected from invalid user jiandong 209.141.33.240 port 50718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.114.170.17
country_id: 6251999
description:
Oct 31 14:31:35 host2 sshd[4084361]: Disconnected from invalid user b 174.114.170.17 port 60062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.222.203.17
country_id: 3686110
description:
Oct 31 14:32:46 host2 sshd[4085721]: Disconnected from invalid user vignesh 129.222.203.17 port 24918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.198.36.42
country_id: 6252001
description:
Oct 31 14:33:58 host2 sshd[4086935]: Disconnected from invalid user jcc 159.198.36.42 port 59056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Oct 31 14:34:11 host2 sshd[4087154]: Disconnected from invalid user admin 103.186.1.197 port 51412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.114.170.17
country_id: 6251999
description:
Oct 31 14:34:17 host2 sshd[4087264]: Disconnected from invalid user venom 174.114.170.17 port 38386 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Oct 31 14:34:21 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7wLEpnBCqqVChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Oct 31 14:35:55 host2 sshd[4089298]: Disconnected from invalid user liu 209.141.33.240 port 60438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.143.100
country_id: 2921044
description:
Oct 31 14:37:58 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.143.100, lip=66.85.158.92, session=<gZiqs3BCOROl449k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.111.54
country_id: 2921044
description:
Oct 31 14:37:59 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.111.54, lip=66.85.158.92, session=<Qre4s3BCpjtA4m82>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.154.24.3
country_id: 798544
description:
Oct 31 14:38:04 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=94.154.24.3, lip=66.85.158.91, TLS, session=<UPrvsnBC/6RemhgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Oct 31 14:37:22 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ffONsXBChNVChJmA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.114.170.17
country_id: 6251999
description:
Oct 31 14:37:55 host2 sshd[4091713]: Disconnected from invalid user www-data 174.114.170.17 port 36912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.180
country_id: 953987
description:
Oct 31 14:38:31 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<training>, method=PLAIN, rip=102.129.57.180, lip=66.85.158.91, TLS, session=<YtRLtHBCBJ1mgTm0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Oct 31 14:38:17 host2 sshd[4092184]: Disconnected from invalid user www-data 209.141.33.240 port 50492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Oct 31 14:40:03 host2 sshd[4094241]: Disconnected from invalid user grafana 103.186.1.197 port 53498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Oct 31 14:40:42 host2 sshd[4094987]: Disconnected from invalid user jcc 209.141.33.240 port 53918 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.251.88
country_id: 2921044
description:
Oct 31 14:44:05 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.251.88, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7BCMyXBCcQ5o+PtY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.251.88
country_id: 2921044
description:
Oct 31 14:44:12 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=104.248.251.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<uDDxyXBCeRBo+PtY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.211.157
country_id: 2921044
description:
Oct 31 14:44:40 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=139.59.211.157, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TV2oy3BCxoeLO9Od>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-10-31 14:46:40 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:33747: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2025-10-31 14:47:01 dovecot_login authenticator failed for (static.bb.ill.59.92.51.186.bsnl.in) [59.92.51.186]:38448: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2025-10-31 14:47:51 dovecot_login authenticator failed for ([61.2.212.194]) [61.2.212.194]:57440: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.231
country_id: 1819730
description:
2025-10-31 14:48:03 dovecot_login authenticator failed for (ADMIN) [86.107.104.231]:55264: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-10-31 14:48:14 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:57491: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-10-31 14:48:43 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:36798: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-10-31 14:50:00 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:36514: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-10-31 14:50:38 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:56372: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.222.203.17
country_id: 3686110
description:
Oct 31 14:52:54 host2 sshd[4110215]: Disconnected from invalid user grafana 129.222.203.17 port 33890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.222.203.17
country_id: 3686110
description:
Oct 31 14:54:53 host2 sshd[4112912]: Disconnected from invalid user appuser 129.222.203.17 port 31332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-10-31 14:54:58 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (parumeale) [5.185.233.251]:43402: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-10-31 14:56:49 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:54214: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-10-31 14:57:20 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:44372: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.53.47.74
country_id: 3175395
description:
2025-10-31 14:59:02 dovecot_login authenticator failed for host-82-53-47-74.retail.telecomitalia.it [82.53.47.74]:52221: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-10-31 14:59:27 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:45234: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 15:00:43 host2 sshd[4119589]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2025-10-31 15:01:07 dovecot_login authenticator failed for apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:49840: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-10-31 15:02:22 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:44552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.235.66.232
country_id: 1269750
description:
2025-10-31 15:02:37 dovecot_login authenticator failed for ([111.235.66.232]) [111.235.66.232]:47363: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Oct 31 15:04:12 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<6XaBEXFCitFChJmI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.80.250
country_id: 6252001
description:
Oct 31 15:05:33 host2 pure-ftpd[4125856]: (?@40.124.80.250) [INFO] New connection from 40.124.80.250


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Oct 31 15:08:18 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.51, lip=66.85.158.91, TLS, session=<gK8vIHFCrPnN0h8z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.171
country_id: 6252001
description:
2025-10-31 15:15:54 dovecot_login authenticator failed for (ADMIN) [191.96.67.171]:13699: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-10-31 15:16:20 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:55922: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-10-31 15:16:39 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:42485: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-10-31 15:17:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (jectorted) [87.103.126.54]:43202: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-31 15:19:06 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:48696: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-10-31 15:22:26 dovecot_login authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:35457: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.135.218
country_id: 2510769
description:
2025-10-31 15:22:35 dovecot_login authenticator failed for (218.pool90-160-135.dynamic.orange.es) [90.160.135.218]:39844: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Oct 31 15:23:24 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<uBEuVnFCdMGLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-10-31 15:27:15 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:58767: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-10-31 15:27:29 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:59408: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-10-31 15:30:03 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:45604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 15:29:49 host2 sshd[4152426]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-10-31 15:30:08 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:60948: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-10-31 15:29:30 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12121: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.233.119
country_id: 2661886
description:
2025-10-31 15:32:27 dovecot_plain authenticator failed for c188-150-233-119.bredband.tele2.se (unmate) [188.150.233.119]:46360: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.184.161
country_id: 2921044
description:
Oct 31 15:35:29 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.184.161, lip=66.85.158.91, session=<UTNagXFC2yOkXLih>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.189.98
country_id: 2921044
description:
Oct 31 15:35:29 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.189.98, lip=66.85.158.91, session=<DQ5hgXFCDOKKxb1i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-10-31 15:36:01 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:42944: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-10-31 15:36:31 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:53931: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.30
country_id: 1269750
description:
2025-10-31 15:38:03 dovecot_login authenticator failed for ([125.19.165.182]) [125.19.156.30]:52230: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-10-31 15:38:26 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:51820: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-10-31 15:41:01 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:41082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Oct 31 15:40:10 host2 sshd[4175943]: Disconnected from invalid user thomas 122.166.254.166 port 42566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2025-10-31 15:41:12 dovecot_login authenticator failed for ([49.125.201.75]) [49.125.201.75]:43516: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.209.134.72
country_id: 6252001
description:
2025-10-31 15:41:21 dovecot_login authenticator failed for chil-nrp2-cs-2103.vdsl.bright.net [66.209.134.72]:57690: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-31 15:41:29 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:35198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Oct 31 15:47:15 host2 sshd[2759]: Disconnected from invalid user sungen 122.166.254.166 port 64341 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-10-31 15:47:37 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (ricerhened) [195.159.217.71]:41832: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2025-10-31 15:50:08 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:50526: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-10-31 15:50:18 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:56904: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Oct 31 15:53:37 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, TLS, session=<TVA+wnFCRtoDWgzA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.254.166
country_id: 1269750
description:
Oct 31 15:58:10 host2 sshd[14877]: Disconnected from invalid user ubuntu 122.166.254.166 port 60359 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Oct 31 15:58:11 host2 pure-ftpd[14903]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Oct 31 16:01:00 host2 sshd[17991]: Disconnected from invalid user mongodb 205.185.127.60 port 38016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.113.253
country_id: 2510769
description:
2025-10-31 16:03:22 dovecot_login authenticator failed for (253.pool90-160-113.dynamic.orange.es) [90.160.113.253]:39255: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-10-31 16:03:33 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:47080: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Oct 31 16:05:10 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eOCK63FCKLNChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-10-31 16:05:13 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:60607: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-10-31 16:08:04 dovecot_login authenticator failed for ([136.228.168.12]) [136.228.168.12]:65527: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-10-31 16:08:26 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:34745: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Oct 31 16:08:54 host2 sshd[27273]: Disconnected from invalid user xbox 205.185.127.60 port 39402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-10-31 16:17:05 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:37894: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-10-31 16:16:11 dovecot_login authenticator failed for ([128.185.215.38]) [128.185.215.38]:51198: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Oct 31 16:16:24 host2 sshd[36677]: Disconnected from invalid user peertube 122.166.254.166 port 48048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-10-31 16:19:05 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:47273: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-10-31 16:19:35 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:58426: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.254.166
country_id: 1269750
description:
Oct 31 16:20:00 host2 sshd[40791]: Disconnected from invalid user narigui 122.166.254.166 port 29689 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Oct 31 16:19:05 host2 sshd[39831]: Disconnected from invalid user user 62.60.131.157 port 56971 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.137.237.34
country_id: 3469034
description:
2025-10-31 16:19:09 dovecot_login authenticator failed for (177.137.237-34.dinamicatelecom.net.br) [177.137.237.34]:45838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.208.233
country_id: 6252001
description:
2025-10-31 16:19:14 dovecot_login authenticator failed for 75.97.208.233.res-cmts.blm.ptd.net [75.97.208.233]:49572: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-31 16:21:26 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:43682: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-10-31 16:21:45 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:50250: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.202
country_id: 1269750
description:
2025-10-31 16:23:59 dovecot_login authenticator failed for ([125.23.229.32]) [27.123.101.202]:35338: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.150.37
country_id: 3057568
description:
2025-10-31 16:24:09 dovecot_login authenticator failed for static-dsl-37.87-197-150.telecom.sk [87.197.150.37]:42593: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.150.160
country_id: 99237
description:
Oct 31 16:28:49 host2 sshd[50571]: Disconnected from invalid user ys 45.157.150.160 port 55152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Oct 31 16:32:07 host2 sshd[54331]: Disconnected from invalid user george 103.143.238.173 port 35364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Oct 31 16:32:43 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, session=<QpsLTnJClBdBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Oct 31 16:33:01 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ewgaT3JCrENAPpxs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Oct 31 16:33:09 host2 dovecot[3961047]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, session=<yUWgT3JC6kxBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Oct 31 16:33:19 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MRMsUHJCFrJAPpxs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Oct 31 16:33:29 host2 sshd[55957]: Disconnected from invalid user weixin 103.143.238.173 port 45924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.150.160
country_id: 99237
description:
Oct 31 16:33:56 host2 sshd[56382]: Disconnected from invalid user weixin 45.157.150.160 port 58032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Oct 31 16:34:49 host2 sshd[57485]: Disconnected from invalid user jonasa 103.143.238.173 port 54898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Oct 31 16:36:05 host2 dovecot[3961047]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<Rg4UWnJCQo4s3lFz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.150.160
country_id: 99237
description:
Oct 31 16:35:30 host2 sshd[58295]: Disconnected from invalid user jonasa 45.157.150.160 port 35568 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.157.150.160
country_id: 99237
description:
Oct 31 16:36:56 host2 sshd[59790]: Disconnected from invalid user marco 45.157.150.160 port 41326 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 16:38:01 host2 sshd[60737]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Oct 31 16:37:55 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<Gy+gYHJCtsZChJly>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.157.150.160
country_id: 99237
description:
Oct 31 16:38:21 host2 sshd[61118]: Disconnected from invalid user developer 45.157.150.160 port 47084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-10-31 16:41:55 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:40192: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.113.62
country_id: 1269750
description:
2025-10-31 16:42:40 dovecot_login authenticator failed for ([103.68.19.170]) [49.36.113.62]:41371: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-10-31 16:42:49 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:56316: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-10-31 16:42:59 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:58824: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.46
country_id: 597427
description:
2025-10-31 16:43:18 dovecot_login authenticator failed for (ADMIN) [194.32.122.46]:32313: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-10-31 16:43:33 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:36642: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-10-31 16:45:36 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:35598: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-10-31 16:46:08 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:43582: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
country_id: 294640
description:
2025-10-31 16:52:00 dovecot_login authenticator failed for ([130.185.96.125]) [130.185.96.125]:60283: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-10-31 16:52:16 dovecot_login authenticator failed for ([177.174.105.113]) [177.174.105.113]:37610: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.109.208
country_id: 1819730
description:
2025-10-31 16:54:05 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:62048: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-10-31 16:54:32 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:58322: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-31 16:56:58 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:34040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-10-31 16:57:12 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:57528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 17:07:09 host2 sshd[95113]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Oct 31 17:08:00 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<DhJDzHJCMt5C8NuS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.219.146
country_id: 6252001
description:
Oct 31 17:07:59 host2 dovecot[3961047]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS, session=<+zcxzHJCSNxC8NuS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Oct 31 17:08:06 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yKOQzHJCBOdC8NuS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.49
country_id: 1643084
description:
Oct 31 17:11:05 host2 sshd[99116]: Disconnected from invalid user damo 103.23.199.49 port 36936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Oct 31 17:11:16 host2 sshd[99218]: Disconnected from invalid user paras 12.156.67.18 port 56822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Oct 31 17:12:36 host2 sshd[100582]: Disconnected from invalid user vyos 12.156.67.18 port 38216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.117
country_id: 3469034
description:
Oct 31 17:12:33 host2 dovecot[3961047]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.200.117, lip=66.85.158.91, session=<DrR83HJCBteYIMh1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.221.242
country_id: 1880251
description:
Oct 31 17:13:58 host2 sshd[101794]: Disconnected from invalid user amp 167.71.221.242 port 33518 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Oct 31 17:13:58 host2 pure-ftpd[101802]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.49
country_id: 1643084
description:
Oct 31 17:15:13 host2 sshd[103282]: Disconnected from invalid user superadmin 103.23.199.49 port 44110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.117
country_id: 3469034
description:
Oct 31 17:15:21 host2 dovecot[3961047]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.200.117, lip=66.85.158.92, session=<y4J/5nJCAOOYIMh1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.221.242
country_id: 1880251
description:
Oct 31 17:15:31 host2 sshd[103622]: Disconnected from invalid user zoneminder 167.71.221.242 port 35542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.49
country_id: 1643084
description:
Oct 31 17:17:09 host2 sshd[105309]: Disconnected from invalid user margaret 103.23.199.49 port 48484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Oct 31 17:17:23 host2 sshd[105473]: Disconnected from invalid user share 12.156.67.18 port 52240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-10-31 17:17:32 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (califie) [73.195.211.98]:55120: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.221.242
country_id: 1880251
description:
Oct 31 17:17:41 host2 sshd[105834]: Disconnected from invalid user michael 167.71.221.242 port 37612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Oct 31 17:18:35 host2 sshd[106697]: Disconnected from invalid user gpadmin 12.156.67.18 port 36916 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.221.242
country_id: 1880251
description:
Oct 31 17:19:12 host2 sshd[107281]: Disconnected from invalid user gpadmin 167.71.221.242 port 39644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Oct 31 17:19:45 host2 sshd[107846]: Disconnected from invalid user max 12.156.67.18 port 60536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-10-31 17:20:41 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:49939: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-10-31 17:20:26 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:59638: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-10-31 17:22:57 dovecot_plain authenticator failed for (genthes) [65.20.250.63]:55278: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 17:24:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65118: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Oct 31 17:25:10 host2 sshd[113444]: Disconnected from invalid user deployer 201.76.120.30 port 32858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.24
country_id: 146669
description:
2025-10-31 17:28:19 dovecot_login authenticator failed for (ADMIN) [185.253.162.24]:11298: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Oct 31 17:28:23 host2 sshd[116801]: Disconnected from invalid user gyt 201.76.120.30 port 38738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.192.185
country_id: 1605651
description:
Oct 31 17:28:24 host2 sshd[116806]: Disconnected from invalid user yas 27.254.192.185 port 41232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-10-31 17:30:02 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:41118: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.192.185
country_id: 1605651
description:
Oct 31 17:29:47 host2 sshd[118249]: Disconnected from invalid user een 27.254.192.185 port 59336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-10-31 17:29:48 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:50305: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2025-10-31 17:31:39 dovecot_login authenticator failed for ([49.125.201.69]) [49.125.201.69]:53980: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-10-31 17:31:15 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:44239: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.192.185
country_id: 1605651
description:
Oct 31 17:32:40 host2 sshd[120980]: Disconnected from invalid user anna 27.254.192.185 port 52072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Oct 31 17:33:42 host2 sshd[122096]: Disconnected from invalid user pentest 51.75.194.10 port 33538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Oct 31 17:34:51 host2 sshd[123313]: Disconnected from invalid user a1 51.75.194.10 port 58824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.148
country_id: 1733045
description:
2025-10-31 17:34:11 dovecot_login authenticator failed for ([49.124.152.148]) [49.124.152.148]:42030: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Oct 31 17:34:26 host2 sshd[122891]: Disconnected from invalid user system 160.251.200.12 port 41442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.188
country_id: 1733045
description:
2025-10-31 17:34:47 dovecot_login authenticator failed for ([49.124.148.188]) [49.124.148.188]:57412: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Oct 31 17:36:33 host2 sshd[125422]: Disconnected from invalid user john 74.249.246.151 port 40334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.194.10
country_id: 3017382
description:
Oct 31 17:37:08 host2 sshd[126162]: Disconnected from invalid user deploy 51.75.194.10 port 53214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Oct 31 17:38:15 host2 sshd[127215]: Disconnected from invalid user wp 160.251.200.12 port 43144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Oct 31 17:39:22 host2 sshd[128480]: Disconnected from invalid user manager 51.75.194.10 port 59850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Oct 31 17:40:24 host2 sshd[129647]: Disconnected from invalid user ubuntu 51.75.194.10 port 56844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Oct 31 17:41:40 host2 sshd[130881]: Disconnected from invalid user user 160.251.200.12 port 60478 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.200.12
country_id: 1861060
description:
Oct 31 17:43:24 host2 sshd[132587]: Disconnected from invalid user hjj 160.251.200.12 port 50034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Oct 31 17:43:38 host2 sshd[132824]: Disconnected from invalid user centos 74.249.246.151 port 50094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Oct 31 17:45:22 host2 sshd[135497]: Disconnected from invalid user admin 187.107.88.97 port 44749 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-10-31 17:46:11 dovecot_plain authenticator failed for (isclogned) [154.144.243.93]:38808: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Oct 31 17:46:48 host2 sshd[137142]: Disconnected from invalid user epc 160.251.200.12 port 60048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.110.174.56
country_id: 3469034
description:
Oct 31 17:47:29 host2 sshd[137763]: Disconnected from invalid user nodeuser 179.110.174.56 port 46238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.143.217
country_id: 3923057
description:
2025-10-31 17:48:27 dovecot_login authenticator failed for (static-181-177-143-217.supernet.com.bo) [181.177.143.217]:64096: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-31 17:48:29 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:51417: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.124
country_id: 2186224
description:
2025-10-31 17:48:39 dovecot_login authenticator failed for ([121.73.169.124]) [121.73.169.124]:50614: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.64
country_id: 1733045
description:
2025-10-31 17:49:06 dovecot_login authenticator failed for ([49.124.151.64]) [49.124.151.64]:36444: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 17:50:55 host2 sshd[141698]: Disconnected from invalid user user 2.57.121.25 port 32939 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.110.174.56
country_id: 3469034
description:
Oct 31 17:51:18 host2 sshd[142238]: Disconnected from invalid user rent 179.110.174.56 port 33850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Oct 31 17:52:05 host2 sshd[143236]: Disconnected from invalid user florian 74.249.246.151 port 42218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.231.192.36
country_id: 1605651
description:
Oct 31 17:52:39 host2 sshd[143674]: Disconnected from invalid user oyepem 49.231.192.36 port 57175 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-10-31 17:52:44 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (roblest) [85.225.19.144]:37478: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-10-31 17:52:49 dovecot_plain authenticator failed for (tradess) [5.32.22.218]:53678: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Oct 31 17:53:46 host2 sshd[144919]: Disconnected from invalid user cs 74.249.246.151 port 39996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Oct 31 17:54:45 host2 sshd[146214]: Disconnected from invalid user smb 43.133.185.172 port 44878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Oct 31 17:55:33 host2 sshd[147215]: Disconnected from invalid user rocket 187.107.88.97 port 36924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Oct 31 17:56:35 host2 sshd[148137]: Disconnected from invalid user brianyu 43.133.185.172 port 53936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.246.151
country_id: 6252001
description:
Oct 31 17:57:17 host2 sshd[148960]: Disconnected from invalid user ubuntu 74.249.246.151 port 42094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Oct 31 17:57:36 host2 sshd[149206]: Disconnected from invalid user smb 202.184.134.84 port 45218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-10-31 17:59:01 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:39088: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-10-31 17:58:08 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:60942: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Oct 31 17:58:54 host2 sshd[150919]: Disconnected from invalid user ria 187.107.88.97 port 37133 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Oct 31 17:59:09 host2 sshd[151448]: Disconnected from invalid user mehrnoosh 202.184.134.84 port 50642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.122
country_id: 719819
description:
2025-10-31 18:01:05 dovecot_login authenticator failed for (ADMIN) [86.106.74.122]:56167: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Oct 31 18:00:41 host2 sshd[153424]: Disconnected from invalid user condor 202.184.134.84 port 44316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Oct 31 18:02:19 host2 sshd[155136]: Disconnected from invalid user test 187.107.88.97 port 58986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.195.206
country_id: 6252001
description:
Oct 31 18:02:45 host2 sshd[155508]: Invalid user visionsolutionshospital from 50.6.195.206 port 48784


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 18:04:08 host2 sshd[158160]: Disconnected from invalid user admin 2.57.121.112 port 46770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-10-31 18:05:42 dovecot_plain authenticator failed for (derse) [65.20.250.163]:42277: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.231.192.36
country_id: 1605651
description:
Oct 31 18:06:40 host2 sshd[161335]: Disconnected from invalid user aradhana 49.231.192.36 port 51210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-10-31 18:07:20 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:35543: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.25.205.249
country_id: 1605651
description:
2025-10-31 18:07:56 dovecot_login authenticator failed for node-14op.pool-125-25.dynamic.totinternet.net (mx-ll-183.89.250-247.dynamic.3bb.in.th) [125.25.205.249]:60687: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.219.146
country_id: 6252001
description:
Oct 31 18:08:18 host2 dovecot[3961047]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS, session=<6b3ko3NCuKVC8NuS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Oct 31 18:08:18 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<npfpo3NCNqpC8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-10-31 18:09:04 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:42270: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.254
country_id: 1733045
description:
2025-10-31 18:09:31 dovecot_login authenticator failed for ([49.124.152.254]) [49.124.152.254]:33640: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.188
country_id: 3017382
description:
Oct 31 18:13:16 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.188, lip=66.85.158.91, session=<NjihtXNCb89bxJi8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Oct 31 18:13:33 host2 sshd[169283]: Disconnected from invalid user bpm_admin 43.155.21.198 port 55640 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.189
country_id: 3017382
description:
Oct 31 18:13:47 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.189, lip=66.85.158.91, session=<LxWCt3NCXalbxJi9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.234.36.180
country_id: 3686110
description:
Oct 31 18:13:10 host2 sshd[168723]: Disconnected from invalid user alina 181.234.36.180 port 43634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.234.36.180
country_id: 3686110
description:
Oct 31 18:14:51 host2 sshd[171176]: Disconnected from invalid user suwat 181.234.36.180 port 46926 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 18:15:33 host2 sshd[172593]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Oct 31 18:16:30 host2 sshd[173887]: Disconnected from invalid user alina 43.155.21.198 port 58008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.125.129
country_id: 1819730
description:
Oct 31 18:17:11 host2 dovecot[3961047]: imap-login: Disconnected: Connection closed: read(size=158) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=165.154.125.129, lip=66.85.158.92, TLS handshaking: read(size=158) failed: Connection reset by peer, session=<+sWow3NCiCGlmn2B>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Oct 31 18:17:53 host2 sshd[175506]: Disconnected from invalid user ambrosio 43.155.21.198 port 50622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.234.36.180
country_id: 3686110
description:
Oct 31 18:18:11 host2 sshd[175902]: Disconnected from invalid user vtorres 181.234.36.180 port 53514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Oct 31 18:18:15 host2 sshd[175945]: Disconnected from invalid user cs 102.88.137.213 port 49680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Oct 31 18:19:10 host2 sshd[176936]: Disconnected from invalid user etherpad 43.155.21.198 port 50096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Oct 31 18:19:44 host2 sshd[177511]: Disconnected from invalid user casa 102.88.137.213 port 1029 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Oct 31 18:20:32 host2 sshd[178601]: Disconnected from invalid user zara 103.186.1.120 port 48422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.234.36.180
country_id: 3686110
description:
Oct 31 18:21:06 host2 sshd[179215]: Disconnected from invalid user cloud 181.234.36.180 port 60094 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Oct 31 18:22:13 host2 dovecot[3961047]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, session=<0cas1XNCCLWUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Oct 31 18:22:30 host2 sshd[181032]: Disconnected from invalid user alina 103.186.1.120 port 53258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Oct 31 18:24:16 host2 sshd[182867]: Disconnected from invalid user gevin 102.88.137.213 port 17404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Oct 31 18:24:26 host2 sshd[183012]: Disconnected from invalid user gevin 103.186.1.120 port 54414 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-10-31 18:32:55 dovecot_plain authenticator failed for (encon) [105.72.176.66]:43214: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.177.170.161
country_id: 6252001
description:
2025-10-31 18:32:59 dovecot_plain authenticator failed for (dicemonerm) [76.177.170.161]:37447: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-10-31 18:36:08 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:46722: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.30
country_id: 1168579
description:
2025-10-31 18:36:36 dovecot_login authenticator failed for (30.92.zcomnetworks.com.pk) [103.148.92.30]:46192: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-10-31 18:38:53 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:47628: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-10-31 18:39:19 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:47525: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 18:44:50 host2 sshd[207162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 18:44:57 host2 pure-ftpd[207252]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 18:44:57 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.177.19, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KRnvJnRClrK58rET>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-10-31 18:45:38 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:56557: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-10-31 18:46:22 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:49256: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.148.106
country_id: 290557
description:
2025-10-31 18:46:34 dovecot_login authenticator failed for ([91.72.148.106]) [91.72.148.106]:33548: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-10-31 18:46:55 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:33796: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.76
country_id: 2661886
description:
2025-10-31 18:48:32 dovecot_login authenticator failed for (ADMIN) [46.246.8.76]:8143: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-10-31 18:49:05 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:46274: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-10-31 18:48:22 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:49144: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-10-31 18:49:12 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (reaverast) [85.225.19.144]:38067: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-10-31 18:51:08 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:62742: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-10-31 18:50:56 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:40614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Oct 31 18:52:51 host2 sshd[215253]: Disconnected from invalid user test 103.145.145.75 port 59454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.111.144
country_id: 3017382
description:
Oct 31 18:52:58 host2 sshd[215311]: Disconnected from invalid user kq 37.59.111.144 port 46288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-10-31 18:57:17 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:38845: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-10-31 18:57:42 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:48846: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.111.144
country_id: 3017382
description:
Oct 31 18:59:56 host2 sshd[222702]: Disconnected from invalid user test 37.59.111.144 port 46734 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@cloudtourssrilanka.com [10/31/2025:13:30:50 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@cloudtourssrilanka.com


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Oct 31 19:00:46 host2 sshd[223811]: Disconnected from invalid user dns 103.145.145.75 port 57592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-10-31 19:02:06 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:56397: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.111.144
country_id: 3017382
description:
Oct 31 19:01:10 host2 sshd[224343]: Disconnected from invalid user klino 37.59.111.144 port 47350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-10-31 19:01:38 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:43579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.111.144
country_id: 3017382
description:
Oct 31 19:02:22 host2 sshd[225848]: Disconnected from invalid user admin 37.59.111.144 port 37794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-10-31 19:02:26 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:58100: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-10-31 19:02:41 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:54249: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Oct 31 19:03:39 host2 sshd[227568]: Disconnected from invalid user ranger 103.145.145.75 port 33076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Oct 31 19:06:35 host2 sshd[230550]: Disconnected from invalid user vinay 103.145.145.75 port 36800 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.248.47
country_id: 2921044
description:
Oct 31 19:07:14 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.248.47, lip=66.85.158.91, TLS, session=<mQqmdnRC9DWkXPgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.22.103
country_id: 6252001
description:
2025-10-31 19:12:55 dovecot_login authenticator failed for (ADMIN) [158.173.22.103]:47601: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-10-31 19:13:30 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (ticheex) [78.66.119.139]:49214: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Oct 31 19:15:20 host2 dovecot[199787]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.92, session=<Iruik3RCeKCl4z73>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.99
country_id: 6252001
description:
Oct 31 19:15:49 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.99, lip=66.85.158.92, TLS handshaking: Connection closed, session=<b9delXRC0K0s3Llj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-10-31 19:16:50 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:60676: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.98.102.173
country_id: 3017382
description:
2025-10-31 19:17:17 dovecot_login authenticator failed for ([79.98.102.173]) [79.98.102.173]:40324: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 50.6.195.206
country_id: 6252001
description:
Oct 31 19:18:25 host2 sshd[243005]: User bostonlanka from 50.6.195.206 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-10-31 19:19:49 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:12025: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-10-31 19:20:26 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:56406: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-10-31 19:25:58 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:55833: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-10-31 19:26:09 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:43169: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-10-31 19:28:13 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:49732: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.106.246
country_id: 6252001
description:
2025-10-31 19:28:27 dovecot_login authenticator failed for ([134.22.106.246]) [134.22.106.246]:57144: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.57.27.185
country_id: 1643084
description:
2025-10-31 19:30:57 dovecot_login authenticator failed for ([202.57.27.185]) [202.57.27.185]:51464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.10
country_id: 2186224
description:
2025-10-31 19:31:47 dovecot_login authenticator failed for ([121.73.168.10]) [121.73.168.10]:33682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.4
country_id: 390903
description:
2025-10-31 19:34:10 dovecot_login authenticator failed for (ADMIN) [79.127.181.4]:56776: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-10-31 19:35:48 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:42158: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.89.103
country_id: 6252001
description:
Oct 31 19:35:24 host2 dovecot[199787]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=52.165.89.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x9FZ23RCPtM0pVln>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Oct 31 19:35:32 host2 sshd[261435]: Disconnected from invalid user minecraft 40.117.97.0 port 47010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-10-31 19:35:42 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:47459: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.74
country_id: 1168579
description:
Oct 31 19:37:58 host2 sshd[263753]: Disconnected from invalid user postgres 154.57.216.74 port 15218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-10-31 19:38:23 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:38964: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-10-31 19:38:29 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:44326: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Oct 31 19:39:22 host2 sshd[265180]: Disconnected from invalid user constructor 40.117.97.0 port 47296 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.71
country_id: 6252001
description:
Oct 31 19:40:42 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.106.71, lip=66.85.158.92, TLS, session=<N4Va7nRCaMUUQGpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.191.147
country_id: 1643084
description:
Oct 31 19:40:49 host2 sshd[266620]: Disconnected from invalid user haekal 210.79.191.147 port 49688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Oct 31 19:42:24 host2 sshd[268092]: Disconnected from invalid user minecraft 111.68.107.91 port 36066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.128.136.184
country_id: 2658434
description:
Oct 31 19:42:38 host2 sshd[268298]: Disconnected from invalid user sftpuser 164.128.136.184 port 49675 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.74
country_id: 1168579
description:
Oct 31 19:44:12 host2 sshd[270033]: Disconnected from invalid user ly 154.57.216.74 port 13591 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.191.147
country_id: 1643084
description:
Oct 31 19:45:42 host2 sshd[272000]: Disconnected from invalid user pawan 210.79.191.147 port 53410 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.128.136.184
country_id: 2658434
description:
Oct 31 19:47:29 host2 sshd[273652]: Disconnected from invalid user ashley 164.128.136.184 port 14237 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.191.147
country_id: 1643084
description:
Oct 31 19:48:51 host2 sshd[275147]: Disconnected from invalid user ts3 210.79.191.147 port 51718 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 19:53:36 host2 sshd[280094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.155
country_id: 1733045
description:
2025-10-31 19:55:02 dovecot_login authenticator failed for ([49.124.154.155]) [49.124.154.155]:32926: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-10-31 19:55:05 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:53458: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-10-31 19:55:04 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:64826: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.199.171.246
country_id: 1269750
description:
2025-10-31 19:55:25 dovecot_login authenticator failed for ([116.199.171.246]) [116.199.171.246]:59572: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.88.209
country_id: 290557
description:
2025-10-31 19:55:36 dovecot_login authenticator failed for ([87.200.88.209]) [87.200.88.209]:38458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.19
country_id: 1733045
description:
2025-10-31 19:55:36 dovecot_login authenticator failed for ([49.124.149.19]) [49.124.149.19]:37704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Oct 31 19:56:36 host2 sshd[283567]: Disconnected from invalid user avinash 212.233.136.201 port 56728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.74
country_id: 1168579
description:
Oct 31 19:57:04 host2 sshd[284084]: Disconnected from invalid user g 154.57.216.74 port 17010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.19
country_id: 2993457
description:
2025-10-31 19:57:58 dovecot_login authenticator failed for (ADMIN) [95.181.233.19]:65503: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-10-31 19:58:02 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:42238: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-10-31 19:58:25 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:59606: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.115.154
country_id: 2750405
description:
[2025-10-31 19:58:41 +0530] info [webmaild] 196.251.115.154 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.74
country_id: 1168579
description:
Oct 31 19:58:57 host2 sshd[285913]: Disconnected from invalid user webrtc 154.57.216.74 port 32471 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Oct 31 20:01:07 host2 sshd[288257]: Disconnected from invalid user saber 212.233.136.201 port 59160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 20:01:14 host2 sshd[288372]: Disconnected from invalid user admin 2.57.121.112 port 12656 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.74
country_id: 1168579
description:
Oct 31 20:03:50 host2 sshd[291796]: Disconnected from invalid user constructor 154.57.216.74 port 16180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.13
country_id: 1733045
description:
2025-10-31 20:03:49 dovecot_login authenticator failed for ([49.124.151.13]) [49.124.151.13]:52954: 535 Incorrect authentication data (set_id=contactus@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-10-31 20:04:42 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:44102: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 20:05:10 host2 sshd[293290]: Disconnected from invalid user admin 2.57.121.112 port 52218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-10-31 20:06:29 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:34962: 535 Incorrect authentication data (set_id=contactus@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-10-31 20:06:42 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:38816: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.229.47
country_id: 2661886
description:
2025-10-31 20:06:13 dovecot_login authenticator failed for 78-73-229-47-no2663.tbcn.telia.com [78.73.229.47]:32991: 535 Incorrect authentication data (set_id=contactus@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-10-31 20:07:24 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (unher) [73.13.220.220]:49302: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-10-31 20:07:27 dovecot_plain authenticator failed for (semetrisy) [84.238.92.245]:35136: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2025-10-31 20:08:44 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:46196: 535 Incorrect authentication data (set_id=contactus@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-10-31 20:08:55 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:42472: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.233.136.201
country_id: 732800
description:
Oct 31 20:09:01 host2 sshd[296993]: Disconnected from invalid user renee 212.233.136.201 port 34562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.210.144.250
country_id: 3017382
description:
Oct 31 20:15:27 host2 sshd[303724]: Disconnected from invalid user deepesh 62.210.144.250 port 33392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Oct 31 20:17:44 host2 sshd[305859]: Disconnected from invalid user salma 94.254.0.234 port 52614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.210.144.250
country_id: 3017382
description:
Oct 31 20:18:59 host2 sshd[306994]: Disconnected from invalid user thiago 62.210.144.250 port 56810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.8.146.58
country_id: 1643084
description:
Oct 31 20:20:05 host2 sshd[308192]: Disconnected from invalid user admins 114.8.146.58 port 49586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.210.144.250
country_id: 3017382
description:
Oct 31 20:20:08 host2 sshd[308354]: Disconnected from invalid user dev 62.210.144.250 port 36960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Oct 31 20:21:29 host2 sshd[309670]: Disconnected from invalid user sinusbot 94.254.0.234 port 33050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.8.146.58
country_id: 1643084
description:
Oct 31 20:21:43 host2 sshd[309791]: Disconnected from invalid user yby 114.8.146.58 port 50440 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 20:23:01 host2 sshd[311143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.254.0.234
country_id: 2661886
description:
Oct 31 20:22:44 host2 sshd[310841]: Disconnected from invalid user webapp 94.254.0.234 port 57184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.210.144.250
country_id: 3017382
description:
Oct 31 20:22:30 host2 sshd[310631]: Disconnected from invalid user test001 62.210.144.250 port 55850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.210.144.250
country_id: 3017382
description:
Oct 31 20:23:40 host2 sshd[311687]: Disconnected from invalid user share 62.210.144.250 port 37654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.209.172
country_id: 1819730
description:
Oct 31 20:29:45 host2 sshd[317983]: Invalid user vulnerabilityplatform from 103.100.209.172 port 44054


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-10-31 20:31:55 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:50319: 535 Incorrect authentication data (set_id=contactus@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-10-31 20:32:36 dovecot_login authenticator failed for ([136.228.168.12]) [136.228.168.12]:57945: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Oct 31 20:34:06 host2 sshd[322989]: Disconnected from invalid user jeffrey 45.172.152.74 port 36962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-10-31 20:34:17 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:51326: 535 Incorrect authentication data (set_id=contactus@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.237.158
country_id: 3469034
description:
2025-10-31 20:34:46 dovecot_login authenticator failed for 177-84-237-158.allrede.tec.br [177.84.237.158]:46376: 535 Incorrect authentication data (set_id=contactus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-10-31 20:37:16 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:51504: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Oct 31 20:37:30 host2 sshd[327550]: Disconnected from invalid user kpatel 122.155.223.9 port 47005 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Oct 31 20:38:21 host2 sshd[328883]: Disconnected from invalid user inter 45.172.152.74 port 47838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.88.31
country_id: 2750405
description:
2025-10-31 20:38:27 dovecot_plain authenticator failed for ([196.251.88.31]) [196.251.88.31]:53962: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-10-31 20:38:47 +0530] info [cpaneld] 196.251.88.31 - euroentertainmentlk "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-10-31 20:40:35 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:51654: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-10-31 20:40:35 dovecot_plain authenticator failed for (proorablid) [102.53.15.180]:30002: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-10-31 20:40:20 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:50451: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-10-31 20:40:31 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (unsight) [174.166.153.20]:45360: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.213
country_id: 2186224
description:
2025-10-31 20:42:28 dovecot_login authenticator failed for ([121.73.162.213]) [121.73.162.213]:34470: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-10-31 20:42:43 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:47088: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.193.174
country_id: 290557
description:
2025-10-31 20:43:23 dovecot_login authenticator failed for (ADMIN) [217.138.193.174]:50518: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.84.217
country_id: 1643084
description:
Oct 31 20:44:24 host2 sshd[336553]: Disconnected from invalid user sr 103.171.84.217 port 41744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-10-31 20:45:49 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:51048: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-10-31 20:45:52 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:51573: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.213
country_id: 1733045
description:
2025-10-31 20:46:08 dovecot_login authenticator failed for ([49.124.152.213]) [49.124.152.213]:40074: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-10-31 20:45:33 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:46740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-10-31 20:47:02 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:45330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.69.224
country_id: 294640
description:
2025-10-31 20:46:14 dovecot_login authenticator failed for (2-55-69-224.orange.net.il) [2.55.69.224]:58221: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.237
country_id: 6252001
description:
Oct 31 20:49:37 host2 dovecot[199787]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.237, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<y3nL5HVCZ8WTuYXt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Oct 31 20:51:07 host2 sshd[346268]: Disconnected from invalid user ritesh 34.124.148.87 port 33692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.84.217
country_id: 1643084
description:
Oct 31 20:50:32 host2 sshd[345413]: Disconnected from invalid user userinex 103.171.84.217 port 57506 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.237
country_id: 6252001
description:
Oct 31 20:50:34 host2 dovecot[199787]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.237, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<D68v6HVCXvGTuYXt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.251.41
country_id: 1819730
description:
Oct 31 20:54:26 host2 sshd[350939]: Disconnected from invalid user smart 152.32.251.41 port 38616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Oct 31 20:55:19 host2 sshd[352273]: Disconnected from invalid user ucpss 209.141.43.77 port 45826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.251.41
country_id: 1819730
description:
Oct 31 20:55:55 host2 sshd[353068]: Disconnected from invalid user nacho 152.32.251.41 port 44776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.237
country_id: 6252001
description:
Oct 31 20:57:04 host2 dovecot[199787]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.237, lip=66.85.158.92, TLS, session=<ZoFt/3VCUu6TuYXt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.237
country_id: 6252001
description:
Oct 31 20:57:27 host2 dovecot[199787]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.237, lip=66.85.158.92, TLS, session=<BfPNAHZCGP+TuYXt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Oct 31 20:57:54 host2 sshd[355745]: Disconnected from invalid user ucpss 152.32.218.149 port 46476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Oct 31 20:58:55 host2 sshd[357017]: Disconnected from invalid user user05 209.141.43.77 port 51608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Oct 31 21:00:29 host2 sshd[359418]: Disconnected from invalid user haha 202.165.22.246 port 36126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-10-31 21:01:56 dovecot_plain authenticator failed for (mingled) [94.204.236.202]:40151: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.95.80
country_id: 1819730
description:
Oct 31 21:01:18 host2 sshd[360791]: Disconnected from invalid user user6 154.12.95.80 port 50794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-10-31 21:01:48 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (untheosin) [68.60.77.128]:58136: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Oct 31 21:01:55 host2 sshd[361480]: Disconnected from invalid user hp 209.141.43.77 port 57396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Oct 31 21:02:11 host2 sshd[361827]: Disconnected from invalid user postgres 202.165.22.246 port 42542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.12.95.80
country_id: 1819730
description:
Oct 31 21:02:34 host2 sshd[362301]: Disconnected from invalid user admin 154.12.95.80 port 44196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.174.113
country_id: 6252001
description:
Oct 31 21:02:44 host2 sshd[362463]: Disconnected from invalid user userinex 198.23.174.113 port 39306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Oct 31 21:02:59 host2 sshd[362805]: Disconnected from invalid user emily 34.124.148.87 port 57832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Oct 31 21:03:11 host2 sshd[363386]: Disconnected from invalid user night 152.32.218.149 port 58896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Oct 31 21:04:51 host2 sshd[366090]: Disconnected from invalid user yoshi 34.124.148.87 port 59406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Oct 31 21:07:03 host2 sshd[368811]: Disconnected from invalid user cperoot 202.165.22.246 port 33558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.12.95.80
country_id: 1819730
description:
Oct 31 21:06:11 host2 sshd[367904]: Disconnected from invalid user postgres 154.12.95.80 port 50220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-10-31 21:07:35 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:40678: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-10-31 21:07:38 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:38804: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-10-31 21:08:03 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:57434: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.174.113
country_id: 6252001
description:
Oct 31 21:08:08 host2 sshd[370089]: Disconnected from invalid user inter 198.23.174.113 port 39580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Oct 31 21:08:35 host2 sshd[370583]: Disconnected from invalid user nacho 34.124.148.87 port 60430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.207
country_id: 1733045
description:
2025-10-31 21:08:23 dovecot_login authenticator failed for ([49.124.148.207]) [49.124.148.207]:34472: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-10-31 21:10:04 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:54137: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Oct 31 21:10:05 host2 sshd[372410]: Disconnected from invalid user postgres 152.32.218.149 port 54318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.52
country_id: 2658434
description:
2025-10-31 21:10:15 dovecot_login authenticator failed for (ADMIN) [158.173.152.52]:5050: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-10-31 21:10:34 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:38947: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Oct 31 21:10:37 host2 sshd[373008]: Disconnected from invalid user respaldo 202.165.22.246 port 46402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-10-31 21:13:19 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com (ulnefloch) [24.97.253.246]:56127: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Oct 31 21:14:27 host2 sshd[377872]: Disconnected from invalid user sam 202.165.22.246 port 59258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-10-31 21:15:44 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:35554: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-10-31 21:15:58 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:43442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-10-31 21:16:00 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:50171: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.124.148.87
country_id: 1880251
description:
Oct 31 21:16:10 host2 sshd[380212]: Disconnected from invalid user ts3 34.124.148.87 port 55752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-10-31 21:16:15 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:36053: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-10-31 21:18:35 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:35798: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.18.240.170
country_id: 3686110
description:
2025-10-31 21:18:56 dovecot_login authenticator failed for ([161.18.240.171]) [161.18.240.170]:50934: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Oct 31 21:19:42 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS: Connection closed, session=<+YZpUHZCpppChJmE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-10-31 21:20:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61059: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-10-31 21:21:15 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:37604: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-10-31 21:21:40 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:43159: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-10-31 21:23:41 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:33442: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-10-31 21:23:59 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:35632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-10-31 21:26:59 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:51684: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.11
country_id: 298795
description:
2025-10-31 21:27:33 dovecot_login authenticator failed for ([188.59.178.11]) [188.59.178.11]:53037: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-10-31 21:28:16 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:54770: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-10-31 21:28:30 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:39264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 21:29:49 host2 sshd[399110]: Disconnected from invalid user admin 2.57.121.112 port 10928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-10-31 21:30:40 dovecot_plain authenticator failed for (ailing) [81.0.54.119]:45772: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Oct 31 21:34:18 host2 dovecot[199787]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.92, session=<gleghHZC5vq4aYtE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.237
country_id: 798544
description:
2025-10-31 21:36:58 dovecot_login authenticator failed for (ADMIN) [138.199.59.237]:36308: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 21:46:32 host2 pure-ftpd[440639]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 21:46:32 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.177.19, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ow5bsHZC4Na58rET>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2025-10-31 21:48:07 dovecot_login authenticator failed for host-188-11-17-169.business.telecomitalia.it [188.11.17.169]:52902: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-10-31 21:47:48 dovecot_login authenticator failed for ([176.30.212.99]) [176.30.212.99]:54632: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 21:49:25 host2 sshd[446233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-10-31 21:49:28 dovecot_plain authenticator failed for (obsemarly) [5.32.22.218]:60359: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Oct 31 21:49:52 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<91RAvHZCpuNAPpyO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 21:49:09 host2 pure-ftpd[445711]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Oct 31 21:49:08 host2 dovecot[415424]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5Z2nuXZCvBtBMQHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.177.19
country_id: 2782113
description:
Oct 31 21:49:09 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.177.19, lip=66.85.158.91, session=<nsy3uXZCGNq58rET>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.144
country_id: 6252001
description:
Oct 31 21:49:34 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4j4yu3ZCbYBAPpyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-10-31 21:50:54 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:41896: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-10-31 21:50:30 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:60488: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-10-31 21:57:20 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:58235: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.146.226
country_id: 2017370
description:
2025-10-31 21:57:35 dovecot_login authenticator failed for (91.200.146-226.in-addr.netone.ru) [91.200.146.226]:60922: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.207.45.220
country_id: 1269750
description:
Oct 31 21:57:43 host2 sshd[460090]: Disconnected from invalid user postmaster 15.207.45.220 port 52910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.86
country_id: 1643084
description:
Oct 31 21:58:51 host2 sshd[461700]: Invalid user cloudtourssrilan_travel from 182.8.225.86 port 28304


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.86
country_id: 1643084
description:
[2025-10-31 21:58:52 +0530] info [cpaneld] 182.8.225.86 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-10-31 21:59:51 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:52346: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-10-31 22:02:04 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:45436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.209.173
country_id: 6252001
description:
Oct 31 22:01:22 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.40.209.173, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5Dpl5XZCtJ0UKNGt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-10-31 22:02:15 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:54820: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.99
country_id: 3703430
description:
2025-10-31 22:03:33 dovecot_login authenticator failed for (ADMIN) [91.90.126.99]:38564: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Oct 31 22:14:05 host2 sshd[481894]: Disconnected from invalid user daeduck 20.12.41.6 port 55000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Oct 31 22:16:31 host2 sshd[485072]: Disconnected from invalid user dgervilla 20.12.41.6 port 51768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Oct 31 22:17:51 host2 sshd[486495]: Disconnected from invalid user vjimenez 20.12.41.6 port 34000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Oct 31 22:17:11 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IMX3HXdCIpxChJmH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 22:18:42 host2 sshd[487673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.99.151
country_id: 3077311
description:
Oct 31 22:18:44 host2 dovecot[415424]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=176.98.99.151, lip=66.85.158.91, TLS, session=<ImpWIndCI5CwYmOX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.201.229.36
country_id: 3469034
description:
Oct 31 22:19:09 host2 dovecot[415424]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=128.201.229.36, lip=66.85.158.91, TLS, session=<QwHJI3dCXOmAyeUk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Oct 31 22:21:15 host2 sshd[491130]: Disconnected from invalid user schaake 205.185.115.224 port 47602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Oct 31 22:23:07 host2 sshd[493516]: Disconnected from invalid user gk 205.185.115.224 port 48110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.171
country_id: 2635167
description:
2025-10-31 22:25:33 dovecot_login authenticator failed for (ADMIN) [158.173.23.171]:56294: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-10-31 22:26:26 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:60080: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.154
country_id: 1733045
description:
2025-10-31 22:26:59 dovecot_login authenticator failed for ([49.124.154.154]) [49.124.154.154]:39570: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-10-31 22:29:04 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:47108: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-10-31 22:29:10 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (hipate) [71.230.228.16]:40686: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-10-31 22:29:26 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:51522: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.104
country_id: 2635167
description:
Oct 31 22:30:00 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.211.104, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5vnJS3dCqN8jy9No>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.104
country_id: 2635167
description:
Oct 31 22:31:00 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.211.104, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<PT5iT3dCfuQjy9No>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.104
country_id: 2635167
description:
Oct 31 22:31:11 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.104, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3PMCUHdChvwjy9No>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-10-31 22:35:28 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:35455: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.30
country_id: 1269750
description:
2025-10-31 22:35:13 dovecot_login authenticator failed for ([125.19.165.182]) [125.19.156.30]:48390: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.104
country_id: 2635167
description:
Oct 31 22:38:06 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.104, lip=66.85.158.91, TLS, session=<D/rBaHdCEPkjy9No>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-10-31 22:37:36 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:47242: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-10-31 22:38:34 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:46196: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-10-31 22:41:06 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (arate) [71.62.34.216]:52060: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-10-31 22:40:24 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:40788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-10-31 22:40:39 dovecot_login authenticator failed for (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:40228: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.102.70
country_id: 783754
description:
Oct 31 22:41:51 host2 sshd[522109]: Disconnected from invalid user emerson 79.106.102.70 port 56056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.30
country_id: 6251999
description:
2025-10-31 22:43:24 dovecot_login authenticator failed for (ADMIN) [37.120.205.30]:60510: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.209
country_id: 6252001
description:
Oct 31 22:45:39 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.209, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<c8XAg3dCBtOH7X7R>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Oct 31 22:47:21 host2 sshd[531130]: Disconnected from invalid user steam 103.13.206.142 port 44892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-10-31 22:47:29 dovecot_plain authenticator failed for (bleags) [80.227.147.94]:33978: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-10-31 22:47:32 dovecot_plain authenticator failed for (fulikers) [64.72.74.162]:58683: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.63
country_id: 241170
description:
Oct 31 22:47:13 host2 sshd[530938]: Disconnected from invalid user ansible 69.5.189.63 port 44022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Oct 31 22:49:38 host2 sshd[534830]: Disconnected from invalid user user 2.57.121.25 port 50620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Oct 31 22:49:31 host2 sshd[534667]: Disconnected from invalid user onyx 79.106.102.70 port 37714 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Oct 31 22:51:17 host2 dovecot[415424]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.206.49, lip=66.85.158.92, TLS, session=<Irnil3dCps+Ucc4x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 22:54:36 host2 sshd[543383]: Disconnected from invalid user admin 2.57.121.112 port 54019 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Oct 31 22:56:44 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GwVlq3dCXFG4aff+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.244.165
country_id: 1819730
description:
Oct 31 22:56:41 host2 sshd[546663]: Disconnected from invalid user user 165.154.244.165 port 34138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Oct 31 22:57:17 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS: Connection closed, session=<RlxhrXdCIC+4aff+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-10-31 22:57:39 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (omangless) [66.177.30.53]:54492: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.165
country_id: 1819730
description:
Oct 31 22:58:21 host2 sshd[549221]: Disconnected from invalid user terraria 165.154.244.165 port 54384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Oct 31 22:58:11 host2 sshd[548960]: Disconnected from invalid user admin 2.57.121.112 port 21482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.208
country_id: 1880251
description:
Oct 31 23:00:30 host2 sshd[551683]: Disconnected from invalid user cy 45.78.216.208 port 55412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-10-31 23:06:59 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:43129: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-10-31 23:07:34 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:55690: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.33
country_id: 1733045
description:
2025-10-31 23:10:09 dovecot_login authenticator failed for ([49.124.153.33]) [49.124.153.33]:60766: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-10-31 23:10:26 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:48638: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.37
country_id: 660013
description:
2025-10-31 23:11:58 dovecot_login authenticator failed for (ADMIN) [188.126.89.37]:15768: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-10-31 23:16:06 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (trical) [2.135.31.74]:33590: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2025-10-31 23:16:27 dovecot_login authenticator failed for ([49.124.151.53]) [49.124.151.53]:44852: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-10-31 23:16:57 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:34680: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.30
country_id: 1733045
description:
2025-10-31 23:18:33 dovecot_login authenticator failed for ([49.124.153.30]) [49.124.153.30]:41036: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-10-31 23:18:50 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:40756: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-10-31 23:21:14 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:50298: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-10-31 23:21:26 dovecot_login authenticator failed for (76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:35420: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.212.233.63
country_id: 3017382
description:
[2025-10-31 23:21:46 +0530] info [cpaneld] 173.212.233.63 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 23:26:45 host2 sshd[592645]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-10-31 23:30:51 dovecot_login authenticator failed for 180.188.76.219.static.netvigator.com [219.76.188.180]:55560: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-10-31 23:30:59 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:47372: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-10-31 23:31:24 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:55392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-10-31 23:31:45 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:38997: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.109
country_id: 3865483
description:
2025-10-31 23:34:54 dovecot_login authenticator failed for (ADMIN) [146.70.38.109]:35734: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Oct 31 23:35:17 host2 pure-ftpd[604897]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Oct 31 23:43:17 host2 pure-ftpd[616151]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-10-31 23:43:50 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:37718: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-10-31 23:44:34 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:47430: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.235.66.232
country_id: 1269750
description:
2025-10-31 23:46:33 dovecot_login authenticator failed for ([111.235.66.232]) [111.235.66.232]:50024: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-10-31 23:46:59 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:45720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.64
country_id: 6252001
description:
Oct 31 23:49:25 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.64, lip=66.85.158.92, session=<PJfKZ3hCjb5APpxA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.52
country_id: 6252001
description:
Oct 31 23:49:38 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.52, lip=66.85.158.92, TLS: Connection closed, session=<+ZGZaHhCHOZAPpw0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-10-31 23:52:40 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:58045: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 1128 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-10-31 23:54:43 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:46653: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-10-31 23:54:57 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:41092: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Oct 31 23:55:40 host2 sshd[634269]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.84.173.178
country_id: 1210997
description:
Oct 31 23:56:21 host2 sshd[635132]: User bostonlanka from 103.84.173.178 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.91.86
country_id: 3017382
description:
Oct 31 23:57:06 host2 sshd[636204]: Invalid user askinternationalconsortium from 51.159.91.86 port 52550


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-10-31 23:57:35 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:45246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-10-31 23:58:18 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:42623: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.179
country_id: 6252001
description:
2025-10-31 23:59:56 dovecot_login authenticator failed for (ADMIN) [212.32.50.179]:40066: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 00:01:07 host2 sshd[642151]: Invalid user askinternationalconsortium from 150.95.31.158 port 57674


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.165
country_id: 6252001
description:
Nov  1 00:02:52 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.165, lip=66.85.158.91, session=<9qzwl3hCJ2JAPsWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Nov  1 00:03:07 host2 dovecot[415424]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.152, lip=66.85.158.91, TLS: Connection closed, session=<SwXMmHhClIhAPsWY>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.102.16.162
country_id: 2661886
description:
Nov  1 00:10:49 host2 sshd[654710]: User bostonlanka from 185.102.16.162 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 193.110.157.47
country_id: 2750405
description:
Nov  1 00:13:25 host2 sshd[658246]: User bostonlanka from 193.110.157.47 not allowed because a group is listed in DenyGroups


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 00:17:19 host2 sshd[663505]: Disconnected from invalid user admin 2.57.121.112 port 15497 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.56
country_id: 1733045
description:
2025-11-01 00:22:05 dovecot_login authenticator failed for ([49.124.145.56]) [49.124.145.56]:32770: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-11-01 00:25:05 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:34332: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-01 00:24:34 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:46406: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  1 00:24:47 host2 sshd[671195]: Invalid user askinternationalconsortium from 51.77.141.29 port 45332


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.93
country_id: 3175395
description:
2025-11-01 00:27:11 dovecot_login authenticator failed for (ADMIN) [156.146.41.93]:52028: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-11-01 00:31:09 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:46374: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-11-01 00:31:27 dovecot_login authenticator failed for ([136.228.168.12]) [136.228.168.12]:50831: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  1 00:31:34 host2 sshd[678271]: Invalid user askinternationalconsortium from 103.84.173.178 port 41924


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-01 00:32:50 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:33993: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-01 00:33:05 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:46281: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-01 00:35:20 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:44756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 00:35:34 host2 sshd[682327]: Disconnected from invalid user kareem 62.60.131.157 port 42103 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2025-11-01 00:35:55 dovecot_login authenticator failed for ([49.125.201.89]) [49.125.201.89]:33340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.27.21
country_id: 1861060
description:
Nov  1 00:36:19 host2 sshd[682996]: Disconnected from invalid user ftpuser 150.95.27.21 port 48804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.193.67
country_id: 1168579
description:
Nov  1 00:36:54 host2 sshd[683696]: Disconnected from invalid user keeper 154.57.193.67 port 50254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.1.60.243
country_id: 1605651
description:
Nov  1 00:37:28 host2 sshd[684246]: Invalid user askinternationalconsortium from 210.1.60.243 port 33876


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  1 00:37:53 host2 sshd[684665]: Invalid user askinternationalconsortium from 57.128.191.199 port 54340


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov  1 00:38:40 host2 sshd[685455]: Disconnected from invalid user kuba 159.223.183.233 port 54108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.193.67
country_id: 1168579
description:
Nov  1 00:39:10 host2 sshd[686019]: Disconnected from invalid user ftpuser 154.57.193.67 port 41100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.27.21
country_id: 1861060
description:
Nov  1 00:39:36 host2 sshd[686463]: Disconnected from invalid user keeper 150.95.27.21 port 44856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov  1 00:39:49 host2 sshd[686653]: Disconnected from invalid user admin 159.223.183.233 port 49464 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  1 00:41:23 host2 sshd[688512]: User bostonlanka from 103.61.225.169 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.183.233
country_id: 6252001
description:
Nov  1 00:42:02 host2 sshd[689128]: Disconnected from invalid user mmm 159.223.183.233 port 44024 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.114
country_id: 2921044
description:
2025-11-01 00:43:09 dovecot_login authenticator failed for (RbdG1irn8o) [158.94.208.114]:58870: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.27.21
country_id: 1861060
description:
Nov  1 00:42:32 host2 sshd[689601]: Disconnected from invalid user redhat 150.95.27.21 port 48276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.193.67
country_id: 1168579
description:
Nov  1 00:42:53 host2 sshd[689848]: Disconnected from invalid user prasad 154.57.193.67 port 33268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.114
country_id: 2921044
description:
2025-11-01 00:43:33 dovecot_login authenticator failed for (PBRs88f) [158.94.208.114]:50709: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.169
country_id: 1733045
description:
2025-11-01 00:44:03 dovecot_login authenticator failed for ([49.124.154.169]) [49.124.154.169]:57572: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-01 00:44:02 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:56144: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.110
country_id: 6252001
description:
Nov  1 00:44:30 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<O6XNLHlCc8rN0h9u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  1 00:44:39 host2 sshd[692179]: Invalid user askinternationalconsortium from 103.61.225.169 port 49454


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-01 00:44:53 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:44392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.114
country_id: 2921044
description:
2025-11-01 00:45:21 dovecot_login authenticator failed for (rIzUT7T) [158.94.208.114]:64008: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-01 00:45:29 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (rotsm) [76.157.219.158]:48154: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.193.67
country_id: 1168579
description:
Nov  1 00:46:36 host2 sshd[694432]: Disconnected from invalid user syukri 154.57.193.67 port 60294 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Nov  1 00:48:37 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<exuDO3lCGcmTuYRJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-01 00:55:19 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:52132: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-11-01 00:57:57 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (propst) [24.61.199.212]:45484: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-01 01:00:17 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:58004: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2025-11-01 00:59:36 dovecot_login authenticator failed for ([49.124.152.222]) [49.124.152.222]:36976: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  1 01:01:20 host2 sshd[711039]: User bostonlanka from 57.128.191.199 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-01 01:02:01 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:52894: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-01 01:02:16 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:51860: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 01:03:24 host2 sshd[713803]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-01 01:04:20 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:52976: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-01 01:04:22 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:52515: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-01 01:04:32 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:43656: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-01 01:04:53 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:33816: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-01 01:08:18 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:60319: 535 Incorrect authentication data (set_id=noreply@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-01 01:08:44 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:45842: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-01 01:10:37 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:33540: 535 Incorrect authentication data (set_id=noreply@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-01 01:10:51 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3002: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 01:11:27 host2 sshd[722198]: User bostonlanka from 104.236.196.180 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 50.6.195.206
country_id: 6252001
description:
Nov  1 01:11:30 host2 sshd[722219]: User agentallianz from 50.6.195.206 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.137.237.34
country_id: 3469034
description:
2025-11-01 01:13:27 dovecot_login authenticator failed for (177.137.237-34.dinamicatelecom.net.br) [177.137.237.34]:46974: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-01 01:13:46 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:33166: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov  1 01:17:39 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: Connection closed, session=<sVBdo3lCLMFChJl5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.110.157.47
country_id: 2750405
description:
Nov  1 01:18:09 host2 sshd[729361]: Invalid user askinternationalconsortium from 193.110.157.47 port 48588


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.95.252.158
country_id: 1814991
description:
2025-11-01 01:18:49 dovecot_login authenticator failed for (641zXvEiVu) [222.95.252.158]:59293: 535 Incorrect authentication data (set_id=dmch@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 01:19:34 host2 sshd[730984]: Invalid user askinternationalconsortium from 104.236.196.180 port 62580


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.95.252.158
country_id: 1814991
description:
2025-11-01 01:19:37 dovecot_login authenticator failed for (FUHLKuH5A) [222.95.252.158]:59923: 535 Incorrect authentication data (set_id=dmch@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.95.252.158
country_id: 1814991
description:
2025-11-01 01:20:25 dovecot_login authenticator failed for (QeFsPZ) [222.95.252.158]:60610: 535 Incorrect authentication data (set_id=dmch@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.125
country_id: 719819
description:
2025-11-01 01:23:20 dovecot_login authenticator failed for (ADMIN) [86.106.74.125]:21488: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  1 01:29:21 host2 sshd[741186]: User bostonlanka from 51.178.137.243 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov  1 01:30:05 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pjLbz3lCTpBChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.31
country_id: 6252001
description:
2025-11-01 01:30:16 dovecot_login authenticator failed for (syn-072-179-206-031.res.spectrum.com) [72.179.206.31]:44425: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-01 01:30:27 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:63738: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 01:31:12 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63079: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 01:32:14 host2 sshd[744408]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-01 01:32:36 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:48900: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-01 01:32:43 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:56911: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.30
country_id: 1269750
description:
2025-11-01 01:36:10 dovecot_login authenticator failed for ([125.19.165.182]) [125.19.156.30]:35810: 535 Incorrect authentication data (set_id=noreply@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 01:37:17 host2 sshd[749819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-01 01:36:46 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:57170: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-01 01:38:20 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:34898: 535 Incorrect authentication data (set_id=noreply@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.8.95
country_id: 6252001
description:
Nov  1 01:37:23 host2 sshd[749798]: Invalid user askinternationalconsortium from 167.99.8.95 port 1508


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-01 01:38:58 dovecot_login authenticator failed for ([191.36.154.175]) [191.36.154.175]:43664: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-11-01 01:44:22 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:40432: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-01 01:46:04 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:54864: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-01 01:46:08 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:36439: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-01 01:46:21 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:44621: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  1 01:45:34 host2 sshd[758898]: Invalid user askinternationalconsortium from 103.247.20.83 port 39492


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2025-11-01 01:46:28 dovecot_login authenticator failed for ([49.124.153.31]) [49.124.153.31]:59324: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-11-01 01:46:54 dovecot_login authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:46834: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-11-01 01:47:10 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:36788: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 01:47:13 host2 sshd[760557]: Disconnected from invalid user rohan 62.60.131.157 port 24560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.170.206.138
country_id: 2635167
description:
2025-11-01 01:49:17 dovecot_login authenticator failed for 109-170-206-138.xdsl.murphx.net [109.170.206.138]:55880: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.202
country_id: 6251999
description:
2025-11-01 01:48:57 dovecot_login authenticator failed for (ADMIN) [37.120.205.202]:52452: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.75.89.78
country_id: 617790
description:
2025-11-01 01:49:06 dovecot_login authenticator failed for (host-static-37-75-89-78.moldtelecom.md) [37.75.89.78]:35611: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.114.115.73
country_id: 6251999
description:
Nov  1 01:54:48 host2 sshd[768474]: Invalid user askinternationalconsortium from 167.114.115.73 port 56660


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  1 01:59:03 host2 sshd[772958]: User bostonlanka from 51.77.141.29 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 02:00:34 host2 sshd[774654]: User bostonlanka from 150.95.31.158 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov  1 02:00:33 host2 sshd[774611]: User bostonlanka from 210.1.60.243 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 02:02:28 host2 sshd[776391]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-11-01 02:03:03 dovecot_plain authenticator failed for (adwayes) [5.32.107.98]:39565: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-01 02:03:05 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (billiesta) [73.13.220.220]:37548: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.75
country_id: 1643084
description:
Nov  1 02:06:46 host2 sshd[781263]: Invalid user askinternationalconsortium from 103.82.93.75 port 47034


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.78
country_id: 3175395
description:
2025-11-01 02:07:52 dovecot_login authenticator failed for (ADMIN) [156.146.41.78]:43458: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-01 02:08:42 dovecot_plain authenticator failed for (olark) [199.192.123.12]:40268: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.185.101
country_id: 2921044
description:
Nov  1 02:09:24 host2 sshd[783866]: Invalid user askinternationalconsortium from 164.92.185.101 port 58186


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.102.16.162
country_id: 2661886
description:
Nov  1 02:12:04 host2 sshd[786670]: Invalid user askinternationalconsortium from 185.102.16.162 port 44824


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.244.229
country_id: 1605651
description:
2025-11-01 02:14:01 dovecot_login authenticator failed for ([58.136.244.229]) [58.136.244.229]:43785: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-01 02:13:24 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35322: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.82.93.75
country_id: 1643084
description:
Nov  1 02:13:40 host2 sshd[788274]: User bostonlanka from 103.82.93.75 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 167.114.115.73
country_id: 6251999
description:
Nov  1 02:13:56 host2 sshd[788520]: User bostonlanka from 167.114.115.73 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.232.19.79
country_id: 2750405
description:
Nov  1 02:14:27 host2 sshd[789123]: Invalid user askinternationalconsortium from 52.232.19.79 port 52096


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-01 02:15:40 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:39914: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-01 02:16:12 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:48481: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-01 02:18:24 dovecot_plain authenticator failed for (overdition) [24.104.225.201]:39382: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-01 02:18:26 dovecot_plain authenticator failed for (thrip) [94.204.236.202]:58517: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-01 02:18:30 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (imour) [98.40.101.10]:36676: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 178.128.27.123
country_id: 1880251
description:
Nov  1 02:21:29 host2 sshd[796150]: User bostonlanka from 178.128.27.123 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-01 02:22:20 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:39424: 535 Incorrect authentication data (set_id=sale@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-01 02:23:44 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:37676: 535 Incorrect authentication data (set_id=sale@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 51.159.91.86
country_id: 3017382
description:
Nov  1 02:24:20 host2 sshd[799437]: User bostonlanka from 51.159.91.86 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.14
country_id: 298795
description:
2025-11-01 02:26:09 dovecot_login authenticator failed for (88.255.189.14.static.ttnet.com.tr) [88.255.189.14]:49184: 535 Incorrect authentication data (set_id=sale@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2025-11-01 02:26:24 dovecot_login authenticator failed for ([49.124.149.208]) [49.124.149.208]:35474: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-01 02:28:27 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:58702: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.136.253.2
country_id: 2635167
description:
2025-11-01 02:28:28 dovecot_login authenticator failed for ([94.136.253.2]) [94.136.253.2]:35322: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.180
country_id: 6252001
description:
2025-11-01 02:28:43 dovecot_login authenticator failed for (ADMIN) [181.214.165.180]:35292: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-01 02:29:12 dovecot_login authenticator failed for ([125.19.93.105]) [182.95.50.154]:41958: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-11-01 02:29:14 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:36954: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 118.194.251.145
country_id: 1605651
description:
Nov  1 02:29:51 host2 pure-ftpd[804893]: (?@118.194.251.145) [INFO] New connection from 118.194.251.145


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.178.81
country_id: 1269750
description:
Nov  1 02:30:53 host2 sshd[806105]: Disconnected from invalid user mminchenok 117.247.178.81 port 39219 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.178.81
country_id: 1269750
description:
Nov  1 02:34:05 host2 sshd[809054]: Disconnected from invalid user roott 117.247.178.81 port 40848 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  1 02:35:06 host2 sshd[810096]: User bostonlanka from 103.146.203.212 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.178.81
country_id: 1269750
description:
Nov  1 02:35:27 host2 sshd[810485]: Disconnected from invalid user philip 117.247.178.81 port 36361 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 02:39:39 host2 sshd[814841]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.6
country_id: 6252001
description:
Nov  1 02:40:39 host2 dovecot[686037]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS, session=<fqAxzHpCfJ/CpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-01 02:42:36 dovecot_plain authenticator failed for (emontolke) [92.62.243.174]:55425: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  1 02:43:12 host2 sshd[818437]: Invalid user askinternationalconsortium from 51.178.137.243 port 38162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-01 02:47:34 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (armate) [67.172.54.29]:42132: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.106
country_id: 6252001
description:
Nov  1 02:49:47 host2 pure-ftpd[825346]: (?@198.235.24.106) [INFO] New connection from 198.235.24.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-11-01 02:50:21 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:43729: 535 Incorrect authentication data (set_id=sale@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.37
country_id: 1733045
description:
2025-11-01 02:53:37 dovecot_login authenticator failed for ([49.124.153.37]) [49.124.153.37]:41764: 535 Incorrect authentication data (set_id=sale@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-01 02:54:01 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:57864: 535 Incorrect authentication data (set_id=sale)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.119
country_id: 3996063
description:
2025-11-01 02:57:37 dovecot_login authenticator failed for (ADMIN) [77.81.142.119]:40792: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-01 02:59:58 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:38874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 03:00:01 host2 sshd[836170]: Disconnected from invalid user admin 2.57.121.112 port 55319 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov  1 02:59:27 host2 sshd[835796]: User bostonlanka from 164.92.185.101 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-11-01 03:00:23 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:50889: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-11-01 03:02:13 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:39035: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.34
country_id: 1733045
description:
2025-11-01 03:02:33 dovecot_login authenticator failed for ([49.124.146.34]) [49.124.146.34]:35520: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 03:03:31 host2 sshd[840251]: User bostonlanka from 165.22.208.59 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 03:03:22 host2 sshd[840133]: Disconnected from invalid user admin 2.57.121.112 port 59768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  1 03:05:31 host2 sshd[843297]: Invalid user askinternationalconsortium from 35.186.147.126 port 52362


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-01 03:05:45 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:41534: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 03:06:57 host2 sshd[845349]: Invalid user askinternationalconsortium from 150.95.31.158 port 43340


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 03:08:23 host2 sshd[847666]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.112.245.92
country_id: 1643084
description:
Nov  1 03:11:46 host2 sshd[851583]: Invalid user askinternationalconsortium from 103.112.245.92 port 34344


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-11-01 03:13:19 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:40294: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-01 03:13:19 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:47104: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-01 03:13:33 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:58848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.148.118
country_id: 2750405
description:
Nov  1 03:19:18 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.148.118, lip=66.85.158.92, TLS: Connection closed, session=<rcdnVntCkIikXJR2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.234
country_id: 6252001
description:
Nov  1 03:19:54 host2 pure-ftpd[860244]: (?@40.124.173.234) [INFO] New connection from 40.124.173.234


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.112.245.92
country_id: 1643084
description:
Nov  1 03:23:22 host2 sshd[863623]: User bostonlanka from 103.112.245.92 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.239.77.168
country_id: 6252001
description:
Nov  1 03:24:22 host2 sshd[864540]: User bostonlanka from 35.239.77.168 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  1 03:26:06 host2 sshd[866471]: User bostonlanka from 35.186.147.126 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.107
country_id: 6252001
description:
2025-11-01 03:25:44 dovecot_login authenticator failed for (ADMIN) [173.244.56.107]:38716: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  1 03:25:59 host2 sshd[866320]: Disconnected from invalid user user 2.57.121.25 port 30347 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  1 03:26:16 host2 sshd[866615]: User bostonlanka from 103.247.20.83 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  1 03:27:28 host2 sshd[867682]: User bostonlanka from 43.135.153.124 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-11-01 03:30:00 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:52335: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-01 03:30:15 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:60938: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  1 03:30:26 host2 sshd[870792]: Invalid user askinternationalconsortium from 43.135.153.124 port 42322


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-01 03:31:32 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:55750: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-11-01 03:31:37 dovecot_login authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:45434: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.242.31.36
country_id: 3355338
description:
2025-11-01 03:33:05 dovecot_login authenticator failed for (c62327.cust.ao.afrisp.net) [160.242.31.36]:47702: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-01 03:32:12 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:37503: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2025-11-01 03:32:12 dovecot_login authenticator failed for 93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:55761: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.45.205
country_id: 6251999
description:
2025-11-01 03:32:17 dovecot_login authenticator failed for dhcp-4-bc-9f-70-1c-86.cpe.i-zoom.net [24.137.45.205]:59941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2840
description:
Nov  1 03:35:01 host2 CROND[875138]: (root) CMD (/usr/bin/update_cpanelv2 --ssl-services &>/dev/null)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  1 03:36:06 host2 sshd[876572]: Invalid user askinternationalconsortium from 150.95.83.190 port 42590


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-01 03:38:05 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br (accera.static.gvt.net.br) [179.184.33.86]:46093: 535 Incorrect authentication data (set_id=root@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-11-01 03:38:42 dovecot_login authenticator failed for (202.140.38.110.convergentindia.com) [202.140.38.110]:59586: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-11-01 03:38:47 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:32813: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-01 03:38:26 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:55086: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-11-01 03:38:36 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:52361: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-11-01 03:38:40 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:39748: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-11-01 03:38:41 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:58212: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-11-01 03:38:57 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:44900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-01 03:38:56 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:56938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-01 03:39:02 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:60796: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.9.176.87
country_id: 3175395
description:
Nov  1 03:39:29 host2 sshd[879888]: Disconnected from invalid user ubnt 79.9.176.87 port 47588 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Nov  1 03:40:41 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, session=<UMrjontCnF6s7OTe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.9.176.87
country_id: 3175395
description:
Nov  1 03:40:48 host2 sshd[881459]: Disconnected from invalid user copia 79.9.176.87 port 45626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-11-01 03:40:30 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:49820: 535 Incorrect authentication data (set_id=root@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Nov  1 03:41:31 host2 sshd[882305]: Disconnected from invalid user ubnt 20.193.141.133 port 52856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.1.60.243
country_id: 1605651
description:
Nov  1 03:41:54 host2 sshd[882671]: Invalid user askinternationalconsortium from 210.1.60.243 port 64602


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov  1 03:41:21 host2 sshd[882154]: Disconnected from invalid user xia 103.224.247.23 port 54230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.9.176.87
country_id: 3175395
description:
Nov  1 03:42:12 host2 sshd[882960]: Disconnected from invalid user orann 79.9.176.87 port 56836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.136.56.211
country_id: 1605651
description:
Nov  1 03:43:09 host2 sshd[883942]: Disconnected from invalid user guest 58.136.56.211 port 59850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-11-01 03:43:24 dovecot_login authenticator failed for ([49.124.155.162]) [49.124.155.162]:46690: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-11-01 03:43:35 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:36440: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 52.232.19.79
country_id: 2750405
description:
Nov  1 03:45:08 host2 sshd[886922]: User bostonlanka from 52.232.19.79 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov  1 03:44:26 host2 sshd[885429]: Disconnected from invalid user zabbix 103.224.247.23 port 34376 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.80
country_id: 6252001
description:
Nov  1 03:44:53 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.80, lip=66.85.158.91, TLS: Connection closed, session=<c3znsXtCLrjHLZtQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Nov  1 03:46:18 host2 sshd[888554]: Disconnected from invalid user userftp 200.118.150.20 port 45962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.224.247.23
country_id: 1269750
description:
Nov  1 03:47:20 host2 sshd[889905]: Disconnected from invalid user liuzhen 103.224.247.23 port 60222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Nov  1 03:49:44 host2 sshd[892630]: Disconnected from invalid user foteini 200.118.150.20 port 58948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.37
country_id: 2963597
description:
2025-11-01 03:50:23 dovecot_login authenticator failed for (ADMIN) [155.2.194.37]:39422: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Nov  1 03:53:04 host2 sshd[897066]: Disconnected from invalid user emanuel 200.118.150.20 port 43692 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.215
country_id: 6252001
description:
Nov  1 03:58:35 host2 pure-ftpd[904801]: (?@205.210.31.215) [INFO] New connection from 205.210.31.215


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  1 04:04:16 host2 sshd[913471]: User bostonlanka from 150.95.83.190 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-01 04:06:35 dovecot_login authenticator failed for ([183.83.51.57]) [183.83.51.57]:50142: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-01 04:06:13 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:34561: 535 Incorrect authentication data (set_id=root@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.209.57
country_id: 174982
description:
2025-11-01 04:08:55 dovecot_login authenticator failed for (host-57.209.77.5.ucom.am) [5.77.209.57]:32949: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-11-01 04:08:11 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:59920: 535 Incorrect authentication data (set_id=root@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.20
country_id: 2993457
description:
2025-11-01 04:08:34 dovecot_login authenticator failed for (ADMIN) [95.181.233.20]:36488: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  1 04:10:06 host2 sshd[922887]: Invalid user askinternationalconsortium from 103.146.203.212 port 40208


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  1 04:10:16 host2 sshd[923273]: Invalid user askinternationalconsortium from 157.245.115.125 port 45114


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.141.6
country_id: 6251999
description:
Nov  1 04:13:52 host2 sshd[928306]: Invalid user askinternationalconsortium from 138.197.141.6 port 57048


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 04:15:56 host2 sshd[931659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.248
country_id: 6252001
description:
Nov  1 04:15:39 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.248, lip=66.85.158.91, TLS, session=<sHzyH3xClvfN0h/4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2025-11-01 04:16:16 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:59940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-01 04:16:37 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:60672: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.36
country_id: 2464461
description:
2025-11-01 04:18:53 dovecot_login authenticator failed for ([102.110.11.36]) [102.110.11.36]:1449: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.44.142
country_id: 1861060
description:
2025-11-01 04:19:04 dovecot_login authenticator failed for p384143-obmd01.tokyo.ocn.ne.jp [60.45.44.142]:41164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  1 04:19:49 host2 sshd[938534]: User bostonlanka from 103.239.165.114 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-01 04:30:26 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:54898: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-01 04:43:00 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:58814: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-01 04:42:27 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:49852: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 04:44:40 host2 sshd[963794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-01 04:45:06 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:36506: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-01 04:45:26 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:49144: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.182.99.92
country_id: 1655842
description:
Nov  1 04:46:22 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=183.182.99.92, lip=66.85.158.91, TLS, session=<G5qbjHxCjpm3tmNc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 223.197.153.143
country_id: 1819730
description:
Nov  1 04:46:44 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=223.197.153.143, lip=66.85.158.91, TLS, session=<IeHojXxCtsPfxZmP>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 138.197.141.6
country_id: 6251999
description:
Nov  1 04:47:00 host2 sshd[966186]: User bostonlanka from 138.197.141.6 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  1 04:50:00 host2 sshd[969009]: User bostonlanka from 103.61.225.169 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-01 04:51:13 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:59982: 535 Incorrect authentication data (set_id=account@maximsholdings.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 04:51:40 host2 sshd[971074]: User bostonlanka from 104.236.196.180 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-11-01 04:51:50 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:50033: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.143
country_id: 1733045
description:
2025-11-01 04:53:09 dovecot_login authenticator failed for ([49.124.152.143]) [49.124.152.143]:43436: 535 Incorrect authentication data (set_id=account@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 04:53:22 host2 sshd[972632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  1 04:53:35 host2 sshd[972841]: Invalid user askinternationalconsortium from 103.61.225.169 port 56782


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.202
country_id: 1269750
description:
2025-11-01 04:54:07 dovecot_login authenticator failed for (dsl-tn-dynamic-065.124.246.61.airtelbroadband.in) [27.123.101.202]:58624: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  1 04:54:33 host2 sshd[974166]: Invalid user askinternationalconsortium from 103.239.165.114 port 34014


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.201
country_id: 3077311
description:
2025-11-01 04:54:44 dovecot_login authenticator failed for (ADMIN) [212.102.39.201]:6755: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-01 04:56:27 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:36599: 535 Incorrect authentication data (set_id=account@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-11-01 04:56:40 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:39120: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.93
country_id: 6252001
description:
Nov  1 04:58:18 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iI51uHxCrdHN0h9d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 05:00:12 host2 sshd[980041]: Invalid user askinternationalconsortium from 104.236.196.180 port 65340


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 05:00:24 host2 sshd[980306]: Invalid user askinternationalconsortium from 165.22.208.59 port 64286


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 05:03:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63179: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov  1 05:06:36 host2 sshd[987286]: User bostonlanka from 210.1.60.243 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 05:07:13 host2 sshd[987870]: User bostonlanka from 150.95.31.158 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 185.102.16.162
country_id: 2661886
description:
Nov  1 05:08:34 host2 sshd[989133]: User bostonlanka from 185.102.16.162 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.134.17.194
country_id: 2328926
description:
Nov  1 05:11:16 host2 sshd[992427]: Disconnected from invalid user sammy 102.134.17.194 port 41854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.153.210
country_id: 6252001
description:
Nov  1 05:11:21 host2 sshd[992490]: Invalid user askinternationalconsortium from 137.184.153.210 port 41346


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.57.188.135
country_id: 2635167
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.57.188.135 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov  1 05:12:19 host2 sshd[993402]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 58056


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.134.17.194
country_id: 2328926
description:
Nov  1 05:15:08 host2 sshd[996438]: Disconnected from invalid user jali 102.134.17.194 port 45744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.157.171
country_id: 1861060
description:
Nov  1 05:15:07 host2 sshd[996428]: Disconnected from invalid user deployer 150.95.157.171 port 52696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov  1 05:16:08 host2 sshd[997516]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 52990


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.195
country_id: 6252001
description:
Nov  1 05:16:13 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<skaL+HxCD8HG6xjD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov  1 05:17:18 host2 sshd[998672]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 57575


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.40
country_id: 2963597
description:
2025-11-01 05:18:04 dovecot_login authenticator failed for (ADMIN) [155.2.194.40]:45001: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 05:17:47 host2 sshd[999087]: Disconnected from invalid user greta 62.60.131.157 port 33663 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov  1 05:19:32 host2 sshd[1000792]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 49682


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-01 05:19:36 dovecot_login authenticator failed for ([182.79.35.233]) [128.185.215.38]:56712: 535 Incorrect authentication data (set_id=account@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-01 05:21:36 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:41539: 535 Incorrect authentication data (set_id=account@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-11-01 05:21:53 dovecot_login authenticator failed for (nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:44880: 535 Incorrect authentication data (set_id=account)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.212
country_id: 6252001
description:
Nov  1 05:22:34 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.212, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5n5ED31CNNDN0h/U>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.134.17.194
country_id: 2328926
description:
Nov  1 05:23:13 host2 sshd[1004689]: Disconnected from invalid user tina 102.134.17.194 port 48274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 05:26:05 host2 sshd[1007966]: Invalid user cloudtourssrilanka from 104.236.196.180 port 18670


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  1 05:26:28 host2 sshd[1008376]: Invalid user cloudtourssrilanka from 157.245.115.125 port 43674


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.135.93.220
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 71.135.93.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.14
country_id: 1269750
description:
2025-11-01 05:27:57 dovecot_login authenticator failed for ([128.185.218.14]) [128.185.218.14]:36594: 535 Incorrect authentication data (set_id=mailbox@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-11-01 05:29:18 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:33724: 535 Incorrect authentication data (set_id=mailbox@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.192.203
country_id: 1522867
description:
2025-11-01 05:29:52 dovecot_login authenticator failed for (2-74-192-203.kcell.kz) [2.74.192.203]:42042: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-01 05:31:50 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:38623: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-01 05:31:57 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:49912: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.59.157.37
country_id: 6252001
description:
2025-11-01 05:32:08 dovecot_login authenticator failed for olp-38-59-157-37.olp.net [38.59.157.37]:35095: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-11-01 05:32:17 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:48755: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-01 05:32:27 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:43074: 535 Incorrect authentication data (set_id=mailbox@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.200.193
country_id: 2802361
description:
Nov  1 05:34:40 host2 pure-ftpd[1017416]: (?@34.79.200.193) [INFO] New connection from 34.79.200.193


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.211.88
country_id: 2750405
description:
Nov  1 05:36:13 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.211.88, lip=66.85.158.91, TLS: Connection closed, session=<o0UXQH1CMo6nY9NY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.152.60
country_id: 6252001
description:
Nov  1 05:38:25 host2 sshd[1022104]: Invalid user askinternationalconsortium from 137.184.152.60 port 57440


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Nov  1 05:38:56 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.219, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kyfHSX1Chc3N0h/b>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.232
country_id: 1819730
description:
Nov  1 05:43:25 host2 sshd[1027561]: Disconnected from invalid user svillaru 118.193.38.232 port 61156 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov  1 05:45:28 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yGAiYX1CoolChJl/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Nov  1 05:45:15 host2 sshd[1030193]: Disconnected from invalid user tempuser 103.76.120.69 port 35242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.69
country_id: 1643084
description:
Nov  1 05:46:45 host2 sshd[1031717]: Disconnected from invalid user explorer 103.76.120.69 port 41936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.25
country_id: 6252001
description:
2025-11-01 05:47:50 dovecot_login authenticator failed for (ADMIN) [102.129.152.25]:57849: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 05:52:07 host2 sshd[1037047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Nov  1 05:52:30 host2 sshd[1037499]: Disconnected from invalid user sidharth 103.76.120.69 port 35452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  1 05:54:20 host2 dovecot[686037]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, TLS: Connection closed, session=<eIbfgH1CUrOUcdUX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.199.12.218
country_id: 2802361
description:
2025-11-01 05:54:27 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:38652: 535 Incorrect authentication data (set_id=mailbox@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.36
country_id: 1733045
description:
2025-11-01 05:57:30 dovecot_login authenticator failed for ([49.124.151.36]) [49.124.151.36]:52128: 535 Incorrect authentication data (set_id=mailbox@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.213
country_id: 1733045
description:
2025-11-01 05:57:50 dovecot_login authenticator failed for ([49.124.152.213]) [49.124.152.213]:51844: 535 Incorrect authentication data (set_id=mailbox)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 05:58:36 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<VCkkkH1C4t8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 05:59:47 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NgdhlH1CgqcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:00:57 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Xy6BmH1CjIkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:01:53 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<YsLbm31Cjs8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:02:28 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<DQzvnX1C/usDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-01 06:03:15 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:35627: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  1 06:03:43 host2 sshd[1050464]: Invalid user askinternationalconsortium from 103.247.20.83 port 51222


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-01 06:03:52 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:45805: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:04:54 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XrGepn1CMuwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:05:32 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<r3vmqH1C3NwDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-01 06:06:07 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:35852: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2025-11-01 06:05:23 dovecot_login authenticator failed for ([49.125.201.89]) [49.125.201.89]:49682: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.166
country_id: 6252001
description:
Nov  1 06:05:28 host2 dovecot[686037]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1kqxqH1CIsLN0h+m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:06:23 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<S132q31CEpEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.51
country_id: 2542007
description:
2025-11-01 06:06:42 dovecot_login authenticator failed for (ADMIN) [95.181.232.51]:42521: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  1 06:07:35 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NJM+sH1COq4DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2025-11-01 06:08:35 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:44980: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-01 06:08:19 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:33995: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  1 06:11:18 host2 sshd[1058630]: Invalid user cloudtourssrilanka from 103.146.203.212 port 44986


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov  1 06:14:03 host2 sshd[1061929]: Disconnected from invalid user manager 165.154.170.25 port 53606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 06:13:40 host2 sshd[1061254]: Invalid user askinternationalconsortium from 150.95.31.158 port 50546


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov  1 06:15:51 host2 sshd[1063952]: Disconnected from invalid user ots 165.154.170.25 port 52466 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 06:20:51 host2 sshd[1069401]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-01 06:22:23 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:45955: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-01 06:22:37 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:49074: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-01 06:22:59 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:46260: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-01 06:23:12 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:50189: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:23:19 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<jrR/6H1CCOIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.1.102
country_id: 1605651
description:
Nov  1 06:25:28 host2 sshd[1073998]: Invalid user askinternationalconsortium from 43.164.1.102 port 58592


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:25:50 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<YzmC8X1C+uoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:27:09 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<FLA+9n1CKt0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:27:30 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<51d9931CiJcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:28:16 host2 dovecot[686037]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Djg7+n1CENoDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:29:52 host2 dovecot[686037]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<8Ufo/31C9uoDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:30:12 host2 dovecot[686037]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<3IIeAX5CDIUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 06:31:13 host2 dovecot[686037]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Qr/ABH5CctwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-01 06:31:56 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:50245: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-01 06:32:12 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:37382: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-11-01 06:34:20 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:43898: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.45
country_id: 390903
description:
2025-11-01 06:34:27 dovecot_login authenticator failed for (ADMIN) [79.127.181.45]:34307: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-11-01 06:34:44 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:60999: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2025-11-01 06:34:46 dovecot_login authenticator failed for ([167.250.118.12]) [167.250.118.12]:35612: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.219.229.99
country_id: 6252001
description:
2025-11-01 06:34:57 dovecot_login authenticator failed for (67-219-229-99.mycomspan.com) [67.219.229.99]:55917: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-11-01 06:34:24 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:55404: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-11-01 06:35:02 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:59896: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.209.172
country_id: 1819730
description:
Nov  1 06:35:07 host2 sshd[1084030]: Invalid user askinternationalconsortium from 103.100.209.172 port 40372


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.37
country_id: 1733045
description:
2025-11-01 06:40:51 dovecot_login authenticator failed for ([49.124.153.37]) [49.124.153.37]:36590: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-11-01 06:41:45 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:55171: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-11-01 06:43:11 dovecot_login authenticator failed for ([178.158.235.131]) [178.158.235.131]:52266: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-01 06:43:25 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:42640: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-01 06:46:00 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:54844: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-01 06:46:27 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:59342: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  1 06:47:01 host2 sshd[1097643]: Invalid user askinternationalconsortium from 103.84.173.178 port 50998


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  1 06:49:23 host2 sshd[1100078]: Invalid user askinternationalconsortium from 43.225.52.249 port 42740


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.44.100.106
country_id: 6252001
description:
Nov  1 06:55:36 host2 sshd[1106879]: Invalid user askinternationalconsortium from 204.44.100.106 port 46408


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-01 06:56:06 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:47788: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-01 06:56:11 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:58076: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-11-01 06:56:28 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:57619: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-01 06:56:38 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:34254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.160
country_id: 2328926
description:
2025-11-01 06:57:48 dovecot_login authenticator failed for (ADMIN) [146.70.65.160]:51603: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.56.47.137
country_id: 1835841
description:
Nov  1 06:59:44 host2 sshd[1110718]: Invalid user askinternationalconsortium from 146.56.47.137 port 53424


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov  1 07:01:35 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.91, TLS: Connection closed, session=<kuRacX5CmtuUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.14.238
country_id: 6252001
description:
Nov  1 07:02:01 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.14.238, lip=66.85.158.91, session=<E8Hqcn5CPo4Uow7u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.27
country_id: 6252001
description:
Nov  1 07:07:32 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.27, lip=66.85.158.92, session=<rLOkhn5COKyH7X0b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov  1 07:11:22 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<J2xelH5CasFChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:11:43 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<kxGWlX5C4q8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-11-01 07:11:46 dovecot_login authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:54525: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-01 07:12:02 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:59958: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:13:19 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<G1tZm35CILkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-01 07:14:28 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:43228: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:14:41 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<asA9oH5CsrIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.3.139.163
country_id: 1819730
description:
2025-11-01 07:14:44 dovecot_login authenticator failed for ([210.3.139.172]) [210.3.139.163]:58755: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:15:18 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eYNyon5CUqwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:16:39 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<yDJGp35CWqIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Nov  1 07:17:14 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.91, TLS: Connection closed, session=<6mhSqX5CNqunXpIw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:17:22 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<fbzWqX5CppYDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-01 07:18:38 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:49841: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-01 07:18:44 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:51754: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:20:04 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lCpxs35CTrEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-01 07:20:58 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:58034: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-01 07:21:10 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:53508: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-11-01 07:20:32 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:59734: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:20:34 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<41M8tX5CXqwDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-01 07:20:52 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:49442: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:21:53 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<VmDwuX5CKMwDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-11-01 07:21:57 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:51514: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.164
country_id: 1562822
description:
2025-11-01 07:21:16 dovecot_login authenticator failed for (ADMIN) [173.239.247.164]:12588: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-01 07:21:21 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:51322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-01 07:21:23 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:43334: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-11-01 07:21:27 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:56052: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-01 07:22:53 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:52816: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:22:32 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<olhIvH5ClrEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-01 07:22:39 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:39048: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:23:50 host2 sshd[1136280]: Disconnected from invalid user julie 103.154.111.3 port 57114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-01 07:25:09 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:55417: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.10
country_id: 2186224
description:
2025-11-01 07:25:33 dovecot_login authenticator failed for ([121.73.168.10]) [121.73.168.10]:42116: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-01 07:25:45 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:34885: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:27:21 host2 sshd[1140083]: Disconnected from invalid user noc 103.154.111.3 port 49220 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:28:19 host2 sshd[1141082]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:28:54 host2 sshd[1141485]: Disconnected from invalid user mj 103.154.111.3 port 48938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  1 07:31:37 host2 sshd[1144489]: Disconnected from invalid user sansforensics 122.166.49.42 port 40112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  1 07:33:05 host2 sshd[1145870]: Disconnected from invalid user oracle 122.166.49.42 port 45992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  1 07:32:17 host2 sshd[1145142]: Invalid user askinternationalconsortium from 43.135.153.124 port 16714


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:33:27 host2 sshd[1146274]: Disconnected from invalid user server 103.154.111.3 port 59162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:35:14 host2 sshd[1148139]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.91.86
country_id: 3017382
description:
Nov  1 07:39:46 host2 sshd[1152728]: Invalid user askinternationalconsortium from 51.159.91.86 port 3665


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:41:41 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<mlDFAH9Ctc+TuYWF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.8
country_id: 3042058
description:
2025-11-01 07:41:43 dovecot_login authenticator failed for (ADMIN) [91.90.122.8]:56896: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:42:17 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<L1bmAn9CfPmTuYWF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:42:50 host2 sshd[1156073]: Disconnected from invalid user dj 103.172.205.139 port 34666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-01 07:44:08 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:56362: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-01 07:44:30 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:63590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-01 07:45:03 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:49610: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:45:04 host2 sshd[1159159]: Disconnected from invalid user ghostuser 103.172.205.139 port 57312 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:45:55 host2 sshd[1160037]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.254.199
country_id: 1252634
description:
2025-11-01 07:45:20 dovecot_login authenticator failed for ([103.127.254.199]) [103.127.254.199]:36082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-01 07:47:42 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:39196: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:49:41 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS, session=<QxRkHX9CWOaTuYWF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-01 07:49:53 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:59940: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.86.212.108
country_id: 6252001
description:
2025-11-01 07:54:27 dovecot_login authenticator failed for ([96.86.212.108]) [96.86.212.108]:47474: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-11-01 07:54:27 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:45198: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-01 07:54:42 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:42942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
country_id: 1269750
description:
2025-11-01 07:55:00 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:50572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-01 07:56:02 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:51542: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:55:16 host2 sshd[1170912]: Disconnected from invalid user sansforensics 103.172.205.139 port 33060 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:57:05 host2 sshd[1173293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.98
country_id: 6252001
description:
Nov  1 07:56:44 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.98, lip=66.85.158.91, session=<41OTNn9CWPnN0h9i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-01 07:56:17 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:39868: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2025-11-01 07:57:54 dovecot_login authenticator failed for ([49.124.155.189]) [49.124.155.189]:54012: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-11-01 07:58:08 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:53956: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-01 07:58:22 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51118: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-01 07:58:43 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:38011: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov  1 07:58:53 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<Dj5PPn9CFMinXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.224
country_id: 1733045
description:
2025-11-01 07:58:58 dovecot_login authenticator failed for ([49.124.152.224]) [49.124.152.224]:58738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.188.38
country_id: 2921044
description:
Nov  1 07:58:21 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.90.188.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XctgPH9CkLCkWrwm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.117.76
country_id: 2510769
description:
2025-11-01 07:58:30 dovecot_login authenticator failed for (76.pool90-160-117.dynamic.orange.es) [90.160.117.76]:34674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-01 07:59:00 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56804: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-01 07:59:03 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:60158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-11-01 07:58:17 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:56928: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-11-01 07:59:20 dovecot_login authenticator failed for ([91.102.231.190]) [91.102.231.190]:60752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-01 08:00:43 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:49396: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 08:02:07 host2 sshd[1180118]: Invalid user askinternationalconsortium from 165.22.208.59 port 37310


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 08:04:54 host2 sshd[1184112]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:04:46 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<86NOU39CycEjy9KZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:06:03 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mIjuV39ClvQjy9KZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  1 08:11:34 host2 sshd[1193822]: Invalid user askinternationalconsortium from 57.128.191.199 port 57172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.2
country_id: 3175395
description:
2025-11-01 08:12:58 dovecot_login authenticator failed for (ADMIN) [156.146.41.2]:34536: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:13:01 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS, session=<mpjVcH9CUvAjy9KZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 08:13:35 host2 sshd[1196712]: Disconnected from invalid user admin 2.57.121.112 port 33481 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  1 08:15:08 host2 sshd[1199106]: Invalid user cloudtourssrilanka from 103.239.165.114 port 50784


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  1 08:17:05 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<G65ef39CSr+LonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 08:17:11 host2 sshd[1201990]: Disconnected from invalid user admin 2.57.121.112 port 59001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  1 08:22:09 host2 sshd[1209193]: Invalid user askinternationalconsortium from 51.77.141.29 port 46232


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Nov  1 08:23:16 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.94, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JRiClX9CUMaTuYRe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.60
country_id: 1168579
description:
2025-11-01 08:24:31 dovecot_login authenticator failed for (60.92.zcomnetworks.com.pk) [103.148.92.60]:40917: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-01 08:25:12 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:41234: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2025-11-01 08:27:18 dovecot_login authenticator failed for ([49.125.201.77]) [49.125.201.77]:48854: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 08:31:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53695: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-01 08:33:26 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:32830: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.204.151.223
country_id: 1210997
description:
2025-11-01 08:33:15 dovecot_login authenticator failed for ([116.204.148.28]) [116.204.151.223]:52450: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.23.109
country_id: 6252001
description:
2025-11-01 08:35:28 dovecot_login authenticator failed for h109.23.29.71.dynamic.ip.windstream.net [71.29.23.109]:37594: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-01 08:35:46 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:24947: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-01 08:38:08 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:48596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-11-01 08:37:50 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:56478: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  1 08:38:25 host2 sshd[1233168]: Invalid user askinternationalconsortium from 118.193.38.159 port 40314


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  1 08:39:13 host2 sshd[1233935]: Invalid user askinternationalconsortium from 51.178.137.243 port 51864


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.101
country_id: 2661886
description:
2025-11-01 08:41:30 dovecot_login authenticator failed for (ADMIN) [212.112.19.101]:12918: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 08:41:36 host2 sshd[1236396]: Invalid user askinternationalconsortium from 104.236.196.180 port 6268


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.165.1.55
country_id: 2921044
description:
Nov  1 08:47:08 host2 sshd[1244131]: Invalid user askinternationalconsortium from 43.165.1.55 port 40138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:50:30 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VCbg9n9C2IIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:51:13 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<WYhx+X9CUJkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:52:26 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<jIrR/X9CYtkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:54:27 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<THMABYBCgMEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:55:50 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VH72CYBCjrYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:56:31 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<S5FnDIBCFo4DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:56:28 host2 dovecot[1088764]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<byMzDIBCsOwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov  1 08:57:14 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<hvH3DoBCxJKnXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-01 08:58:58 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:54997: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-01 08:59:07 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:37065: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-01 08:59:11 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:38129: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:58:32 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2RefE4BClogDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.125.83.110
country_id: 630336
description:
2025-11-01 08:58:57 dovecot_login authenticator failed for leased-line-93-125-83-110.telecom.by [93.125.83.110]:57319: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-01 09:01:40 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:57698: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-01 09:02:02 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:58643: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.142
country_id: 798549
description:
2025-11-01 09:01:20 dovecot_login authenticator failed for (ADMIN) [91.90.120.142]:50812: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-11-01 09:03:58 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:57038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-01 09:04:11 dovecot_login authenticator failed for (abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:58446: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 09:04:26 host2 sshd[1262995]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 09:07:31 host2 sshd[1265883]: Invalid user cloudtourssrilanka from 104.236.196.180 port 42010


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-01 09:09:59 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:58520: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-01 09:10:16 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:33246: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-11-01 09:12:11 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:38940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-01 09:14:58 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:42080: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-01 09:14:49 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.8.95
country_id: 6252001
description:
Nov  1 09:15:10 host2 sshd[1274151]: Invalid user askinternationalconsortium from 167.99.8.95 port 60258


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.37
country_id: 6252001
description:
Nov  1 09:15:38 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.37, lip=66.85.158.92, TLS, session=<CJHFUIBCgOfG6xgl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 09:21:50 host2 sshd[1281378]: Invalid user askinternationalconsortium from 150.95.31.158 port 51542


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.88
country_id: 2963597
description:
2025-11-01 09:26:59 dovecot_login authenticator failed for (ADMIN) [155.2.194.88]:12961: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 09:30:11 host2 sshd[1289902]: Disconnected from invalid user admin 2.57.121.112 port 25821 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 09:33:16 host2 sshd[1292870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-01 09:33:58 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:51164: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-01 09:34:39 dovecot_login authenticator failed for ([122.186.172.97]) [152.52.236.158]:36788: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-01 09:34:11 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:33488: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.23
country_id: 298795
description:
2025-11-01 09:38:41 dovecot_login authenticator failed for ([188.59.178.23]) [188.59.178.23]:54053: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-01 09:38:59 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:33220: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-11-01 09:41:05 dovecot_login authenticator failed for ([49.124.151.82]) [49.124.151.82]:56578: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-01 09:41:26 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:41626: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-11-01 09:44:27 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:4791: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-01 09:44:49 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:35742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-01 09:44:17 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:35535: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:45:54 host2 sshd[1307120]: Disconnected from invalid user pang 42.200.66.164 port 52118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-01 09:45:17 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:39904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-01 09:47:03 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:36974: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.62
country_id: 1269750
description:
2025-11-01 09:49:05 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:49594: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.109
country_id: 3865483
description:
2025-11-01 09:49:23 dovecot_login authenticator failed for (ADMIN) [146.70.38.109]:49314: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-01 09:50:01 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3108: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:51:21 host2 sshd[1312680]: Disconnected from invalid user ftpuser 42.200.66.164 port 59802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-01 09:52:24 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:59072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:52:40 host2 sshd[1313879]: Disconnected from invalid user hydra 42.200.66.164 port 33484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  1 09:53:40 host2 sshd[1314834]: Invalid user askinternationalconsortium from 35.186.147.126 port 36274


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:53:55 host2 sshd[1315059]: Disconnected from invalid user debian 42.200.66.164 port 35398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:55:11 host2 sshd[1316921]: Disconnected from invalid user ricoh 42.200.66.164 port 37310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  1 09:55:42 host2 sshd[1317530]: Invalid user askinternationalconsortium from 150.95.83.190 port 58244


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  1 10:00:54 host2 sshd[1322962]: Invalid user askinternationalconsortium from 43.225.52.249 port 44280


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2025-11-01 10:04:14 dovecot_login authenticator failed for ([49.124.151.53]) [49.124.151.53]:50056: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-01 10:04:40 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:50292: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.199
country_id: 2186224
description:
2025-11-01 10:05:15 dovecot_login authenticator failed for ([121.73.161.199]) [121.73.161.199]:59938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.218
country_id: 1733045
description:
2025-11-01 10:05:16 dovecot_login authenticator failed for ([49.124.152.218]) [49.124.152.218]:53342: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov  1 10:07:06 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<+wLQCIFCbtlChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  1 10:06:44 host2 dovecot[1299590]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<tjGHB4FCMoQD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.232.19.79
country_id: 2750405
description:
Nov  1 10:11:38 host2 sshd[1334650]: Invalid user askinternationalconsortium from 52.232.19.79 port 38478


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.11
country_id: 6251999
description:
2025-11-01 10:12:33 dovecot_login authenticator failed for (ADMIN) [37.120.205.11]:60962: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:12:49 host2 sshd[1335955]: Disconnected from invalid user yang 34.69.0.72 port 33122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-01 10:15:51 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:46283: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.75
country_id: 1643084
description:
Nov  1 10:15:51 host2 sshd[1339319]: Invalid user askinternationalconsortium from 103.82.93.75 port 55856


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-01 10:15:36 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:37934: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.201.205
country_id: 6252001
description:
Nov  1 10:15:42 host2 sshd[1339182]: Invalid user askinternationalconsortium from 134.199.201.205 port 43504


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-01 10:18:01 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:33606: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-01 10:18:22 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:58212: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.201.205
country_id: 6252001
description:
Nov  1 10:18:33 host2 sshd[1341922]: Invalid user cloudtourssrilanka from 134.199.201.205 port 51592


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:19:27 host2 sshd[1343108]: Disconnected from invalid user switching 34.69.0.72 port 50688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.7.163.154
country_id: 1643084
description:
Nov  1 10:20:35 host2 sshd[1344549]: Invalid user askinternationalconsortium from 114.7.163.154 port 56936


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:20:49 host2 sshd[1344787]: Disconnected from invalid user info 34.69.0.72 port 36160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.209.172
country_id: 1819730
description:
Nov  1 10:22:05 host2 sshd[1346279]: Invalid user cloudtourssrilanka from 103.100.209.172 port 21508


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.198.109.95
country_id: 2635167
description:
2025-11-01 10:24:40 dovecot_login authenticator failed for ([213.198.109.95]) [213.198.109.95]:47000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.215
country_id: 1269750
description:
2025-11-01 10:24:27 dovecot_login authenticator failed for (nsg-corporate-215.230.187.122.airtel.in) [122.187.230.215]:51417: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.117
country_id: 6252001
description:
Nov  1 10:26:03 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.117, lip=66.85.158.91, TLS: Connection closed, session=<I3yaTIFCwtLHLZp1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.199.163.128
country_id: 2635167
description:
2025-11-01 10:26:26 dovecot_login authenticator failed for 128.163.199.146.dyn.plus.net [146.199.163.128]:35746: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-01 10:26:56 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:52706: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-01 10:27:00 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:38053: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-01 10:26:15 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:51660: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-01 10:26:18 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:42038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  1 10:28:01 host2 sshd[1352466]: Invalid user askinternationalconsortium from 103.247.20.83 port 55400


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.119.132.230
country_id: 2510769
description:
2025-11-01 10:29:27 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:37424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-01 10:29:48 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50720: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.19
country_id: 6290252
description:
2025-11-01 10:37:02 dovecot_login authenticator failed for (ADMIN) [37.46.115.19]:42954: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 10:37:45 host2 sshd[1363023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.69.10.175
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.69.10.175 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov  1 10:44:42 host2 sshd[1370834]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 60310


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 10:46:38 host2 sshd[1373358]: Disconnected from invalid user admin 2.57.121.112 port 8579 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-01 10:48:13 dovecot_login authenticator failed for ([1.7.229.162]) [49.37.32.248]:57324: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.21.213
country_id: 1269750
description:
2025-11-01 10:48:54 dovecot_login authenticator failed for (213-21.211.103.static.gtplkcbpl.in) [103.211.21.213]:48751: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-01 10:49:01 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:48224: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.89
country_id: 2264397
description:
Nov  1 10:50:51 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.128.89, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<erdDpYFCX8gtnIBZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.30
country_id: 2264397
description:
Nov  1 10:51:01 host2 pure-ftpd[1378059]: (?@109.105.209.30) [INFO] New connection from 109.105.209.30


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.29
country_id: 2264397
description:
Nov  1 10:50:59 host2 pure-ftpd[1378044]: (?@109.105.209.29) [INFO] New connection from 109.105.209.29


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 10:50:12 host2 sshd[1377324]: Disconnected from invalid user admin 2.57.121.112 port 26339 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.87
country_id: 2264397
description:
Nov  1 10:50:49 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.87, lip=66.85.158.92, TLS, session=<5GgnpYFC1dstnIBX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.28
country_id: 2264397
description:
Nov  1 10:51:02 host2 pure-ftpd[1378173]: (?@109.105.209.28) [INFO] New connection from 109.105.209.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.27
country_id: 2264397
description:
Nov  1 10:51:03 host2 pure-ftpd[1378175]: (?@109.105.209.27) [INFO] New connection from 109.105.209.27


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.87
country_id: 2264397
description:
Nov  1 10:50:44 host2 dovecot[1299590]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.87, lip=66.85.158.92, TLS, session=<xSrdpIFCM5YtnIBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  1 10:50:47 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<pj8SpYFCDKItnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.88
country_id: 2264397
description:
Nov  1 10:50:58 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<v3uupYFCR7otnIBY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.56.26
country_id: 1269750
description:
2025-11-01 10:57:32 dovecot_login authenticator failed for ([59.145.127.41]) [122.187.56.26]:44866: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.220.228
country_id: 99237
description:
2025-11-01 10:57:47 dovecot_login authenticator failed for ([93.191.115.52]) [194.31.220.228]:37221: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-01 10:57:50 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41836: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-01 10:58:13 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:35492: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.202.254
country_id: 2510769
description:
2025-11-01 10:58:30 dovecot_login authenticator failed for 254.red-88-9-202.dynamicip.rima-tde.net [88.9.202.254]:60226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  1 11:00:03 host2 sshd[1388512]: Invalid user askinternationalconsortium from 64.227.136.122 port 41788


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-01 11:01:23 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:32912: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-01 11:01:35 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:48152: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-01 11:01:38 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:47952: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-01 11:02:08 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:42733: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-01 11:02:18 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:38030: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.9
country_id: 1733045
description:
2025-11-01 11:02:27 dovecot_login authenticator failed for ([49.124.153.9]) [49.124.153.9]:58982: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-01 11:01:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:44732: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-01 11:01:47 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:52750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.211.97
country_id: 6252001
description:
Nov  1 11:03:50 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.211.97, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rla504FCWcstT9Nh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  1 11:04:14 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, session=<Umsq1YFCbNKUcd3D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.197
country_id: 3469034
description:
2025-11-01 11:05:18 dovecot_login authenticator failed for (ADMIN) [188.241.177.197]:48315: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:06:39 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gT3G3YFC7NEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 11:05:54 host2 sshd[1394748]: Invalid user askinternationalconsortium from 165.22.208.59 port 44360


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-01 11:06:04 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:55240: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-01 11:06:56 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:48316: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:07:39 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1PFW4YFCxNwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:08:36 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tZ/B5IFCgKQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.146.21.153
country_id: 1605651
description:
Nov  1 11:08:09 host2 sshd[1397002]: Invalid user askinternationalconsortium from 203.146.21.153 port 45666


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:08:40 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+9j+5IFCyI8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.125.83.110
country_id: 630336
description:
2025-11-01 11:08:49 dovecot_login authenticator failed for leased-line-93-125-83-110.telecom.by ([91.149.142.21]) [93.125.83.110]:34719: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-01 11:09:02 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:34280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:10:33 host2 dovecot[1299590]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=</xq764FCVpADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:10:53 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Gjbq7IFC2IkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:11:55 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZuSc8IFCwLkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  1 11:12:17 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<ZZnx8YFCQr4DU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.105
country_id: 6252001
description:
Nov  1 11:12:18 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.105, lip=66.85.158.92, session=<tNr/8YFCDNQUQcNp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:12:53 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UAET9IFCxuUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  1 11:13:00 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6gd89IFCmGTUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:13:51 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<BF6F94FCvN0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.67
country_id: 6252001
description:
Nov  1 11:14:48 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.67, lip=66.85.158.91, session=<Wn30+oFCOrsUQcBD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:14:52 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CPUu+4FCDpsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:15:47 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<54Z1/oFCpLYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-11-01 11:29:41 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:57464: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-01 11:33:47 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:59258: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2025-11-01 11:34:07 dovecot_login authenticator failed for ([49.124.142.135]) [49.124.142.135]:40560: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-01 11:35:42 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:47968: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-01 11:36:25 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:50155: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  1 11:38:34 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, session=<YYHpT4JCmImUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.153.210
country_id: 6252001
description:
Nov  1 11:39:14 host2 sshd[1432472]: Invalid user agronatureholdings from 137.184.153.210 port 36984


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  1 11:40:21 host2 sshd[1433811]: Invalid user agronatureholdings from 143.110.213.247 port 39470


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.75.89.78
country_id: 617790
description:
2025-11-01 11:42:39 dovecot_login authenticator failed for (host-static-37-75-89-78.moldtelecom.md) [37.75.89.78]:57553: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-01 11:41:59 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:46072: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-01 11:44:00 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:51933: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-01 11:44:23 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:54086: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-01 11:47:15 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:45683: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.144
country_id: 1733045
description:
2025-11-01 11:46:56 dovecot_login authenticator failed for ([49.124.152.144]) [49.124.152.144]:40896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.33
country_id: 732800
description:
2025-11-01 11:52:50 dovecot_login authenticator failed for (ADMIN) [94.156.14.33]:51286: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-01 11:57:37 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:38725: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-01 11:58:00 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:36840: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-01 11:58:35 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:38674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-11-01 11:57:50 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:32454: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 12:02:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63567: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 12:02:43 host2 sshd[1458169]: Disconnected from invalid user admin 2.57.121.112 port 47250 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.192.245
country_id: 6252001
description:
Nov  1 12:07:55 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.192.245, lip=66.85.158.92, session=<EKbsuIJCbOlK+cD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.117.55
country_id: 6252001
description:
Nov  1 12:09:23 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.102.117.55, lip=66.85.158.91, session=<nw8qvoJCtKsUZnU3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-11-01 12:10:29 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:52224: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.101.248
country_id: 1269750
description:
2025-11-01 12:11:31 dovecot_login authenticator failed for ([14.102.101.248]) [14.102.101.248]:41013: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-01 12:13:06 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:53052: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-01 12:13:28 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:38509: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.154
country_id: 798549
description:
2025-11-01 12:13:31 dovecot_login authenticator failed for (ADMIN) [91.90.120.154]:40652: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-11-01 12:19:19 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:56439: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.181.177.244
country_id: 2029969
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.181.177.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.33.70.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 75.33.70.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.27.53.229
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 125.27.53.229 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.246.49
country_id: 1282988
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.225.246.49 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.191.236
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.48.191.236 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.183.203.230
country_id: 2510769
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.183.203.230 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.206.152.163
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.206.152.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.222.160
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 51.36.222.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.153.203.18
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 85.153.203.18 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.115.66.158
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 190.115.66.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.107.90.124
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.107.90.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.34.69
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 138.84.34.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.123.54
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.167.123.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.174.68.50
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.174.68.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.218.49.225
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.218.49.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.252.198.217
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.252.198.217 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.53.34.162
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 60.53.34.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.190.107.201
country_id: 3508796
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.190.107.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.155.39
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 161.142.155.39 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.231.101
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.49.231.101 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.17.209
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.251.17.209 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.113.153
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.65.113.153 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.3.45
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.161.3.45 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.49.3.84
country_id: 458258
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 92.49.3.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.103.185.26
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.103.185.26 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.182.159
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.167.182.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.11.223
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.141.11.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.151.198
country_id: 587116
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 62.217.151.198 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.206.63.196
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.206.63.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.236.188.134
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 70.236.188.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.32.195.203
country_id: 3686110
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 179.32.195.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.252.63
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.128.252.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.124.156.22
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.124.156.22 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.105.84
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.189.105.84 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.88.234.155
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 183.88.234.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.83.121
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.62.83.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.196.38.123
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 146.196.38.123 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.108.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.217.108.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.72.84
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 46.110.72.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.157.38
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 174.106.157.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.224.104
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 49.43.224.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.250.238
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.150.250.238 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.22.228
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.241.22.228 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.246.167
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 35.150.246.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.243.106.73
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.243.106.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.58.97.140
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.58.97.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.56.133.228
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.56.133.228 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.195.146.219
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.195.146.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.195.97.27
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 107.195.97.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.79.22.44
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.79.22.44 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.183.72
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.151.183.72 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.57.252.181
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.57.252.181 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.44.183.216
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.44.183.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.31.86.207
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.31.86.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.59.90.13
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.59.90.13 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.121.235.171
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 78.121.235.171 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.118.166
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 152.59.118.166 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.57.175.15
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 152.57.175.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.29.185
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.32.29.185 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.162.148.43
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 122.162.148.43 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.233.51.61
country_id: 2963597
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 80.233.51.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.64.127.5
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 71.64.127.5 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.122.152.214
country_id: 294640
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.122.152.214 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.234.8.23
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 171.234.8.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.165.11.116
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 179.165.11.116 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.212.113.102
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 117.212.113.102 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.195.88.127
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.195.88.127 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.34.103.6
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 201.34.103.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.133.41
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 143.255.133.41 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.211.52.7
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.211.52.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.61.142.27
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.61.142.27 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.102.174.244
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.102.174.244 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.146.113.148
country_id: 587116
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.146.113.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.196.207.237
country_id: 3996063
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 189.196.207.237 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.89.72.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.89.72.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.225.107
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.22.225.107 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.64.207
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 151.254.64.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.96.201
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 100.0.96.201 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.156.214
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.19.156.214 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.174.71.124
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.174.71.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.183.79
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.37.183.79 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.107.212.163
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 150.107.212.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.207.76
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.187.207.76 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.127.45.9
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.127.45.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.184.34
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.36.184.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.248.234.18
country_id: 6290252
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 94.248.234.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.201.132.152
country_id: 1694008
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 112.201.132.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.49.54.113
country_id: 3439705
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.49.54.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.8.166
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.47.8.166 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.56.163
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 35.151.56.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.36.102.32
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.36.102.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.7.118
country_id: 630336
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.214.7.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.237.22.93
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 186.237.22.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.62.31.211
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.62.31.211 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.197.138.106
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.197.138.106 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.30.188
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.46.30.188 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.107.204.137
country_id: 783754
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 95.107.204.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.21.140.46
country_id: 286963
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 5.21.140.46 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.222.237.131
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 179.222.237.131 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.254.121
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.106.254.121 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.18.120.7
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.18.120.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


