# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 08:05:21 host2 sshd[4187165]: Disconnected from invalid user ahsan 172.190.117.128 port 35114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 19 08:06:07 host2 sshd[4187546]: Disconnected from invalid user luke 79.6.62.97 port 54130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-19 08:09:21 dovecot_plain authenticator failed for (bliked) [65.20.205.197]:34618: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.109
country_id: 3865483
description:
Nov 19 08:13:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.195.109, lip=66.85.158.91, TLS, session=<rK0QjOlDxti14cNt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.92
country_id: 3469034
description:
Nov 19 08:14:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=200.196.143.92, lip=66.85.158.91, TLS, session=<TOJsjelDl8jIxI9c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 19 08:14:35 host2 sshd[4192103]: Disconnected from invalid user victor 79.6.62.97 port 49204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-19 08:19:24 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:56860: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-19 08:19:52 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:45286: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.35
country_id: 798544
description:
Nov 19 08:23:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=128.127.94.35, lip=66.85.158.91, TLS, session=<+I5FrulDLbiAf14j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.48
country_id: 3175395
description:
Nov 19 08:23:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.48, lip=66.85.158.91, TLS, session=<+bJRr+lDtKWrFusw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-11-19 08:26:00 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:57148: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-19 08:25:42 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:52772: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Nov 19 08:27:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS: Connection closed, session=<oKK9vOlDtEynXpIz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 19 08:31:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<UdfLy+lDmqeLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2025-11-19 08:34:19 dovecot_login authenticator failed for (red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:58387: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-19 08:34:49 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:33778: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 08:37:51 host2 sshd[13434]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 08:49:32 host2 sshd[23736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 19 08:52:26 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<myTuFupD0OMs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-19 09:16:44 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:58568: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-11-19 09:16:57 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:50500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.84
country_id: 2510769
description:
Nov 19 09:25:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.229.98.84, lip=66.85.158.91, TLS, session=<9jXXjepDRKy55WJU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.212
country_id: 3469034
description:
Nov 19 09:26:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.212, lip=66.85.158.91, TLS, session=<uFvwjupDeuC+WYjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.158
country_id: 3865483
description:
Nov 19 09:27:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.181.101.158, lip=66.85.158.91, TLS, session=<u76Uk+pDwJ2+tWWe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.34
country_id: 3469034
description:
Nov 19 09:28:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=177.93.165.34, lip=66.85.158.91, TLS, session=<V2xxlepDH8axXaUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.169
country_id: 6252001
description:
Nov 19 09:29:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.169, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4iOgm+pDHt+TuYWp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.96.38
country_id: 2750405
description:
Nov 19 09:32:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.96.38, lip=66.85.158.92, session=<66g5pupDvsnRJmAm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:33:22 host2 sshd[52970]: Disconnected from invalid user test 103.210.22.105 port 46240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 19 09:34:10 host2 sshd[53378]: Disconnected from invalid user john 125.31.2.160 port 58850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 19 09:36:02 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<XQHcsupD7rsD7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.169
country_id: 6252001
description:
Nov 19 09:35:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.169, lip=66.85.158.91, TLS, session=<5+BosepDNvyTuYWp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:36:32 host2 sshd[54837]: Disconnected from invalid user md 103.210.22.105 port 36604 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:38:03 host2 sshd[55850]: Disconnected from invalid user zt 103.210.22.105 port 49172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:39:34 host2 sshd[56715]: Disconnected from invalid user sysadmin 103.210.22.105 port 51436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 19 09:40:36 host2 sshd[57547]: Disconnected from invalid user zt 125.31.2.160 port 60746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.219.121
country_id: 2750405
description:
Nov 19 09:52:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.219.121, lip=66.85.158.91, session=<ruba7OpD0NukXNt5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.111
country_id: 3175395
description:
Nov 19 09:54:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.234.111, lip=66.85.158.91, TLS, session=<h7xg9OpD1tKrFupv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.48
country_id: 798544
description:
Nov 19 09:54:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.29.48, lip=66.85.158.91, TLS, session=<8yGZ9epDpJiy2B0w>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-19 09:56:42 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:36691: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-19 09:57:00 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:37899: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PaMVDOtDod6i2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:02:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<fjnnD+tDpPOi2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:02:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<O7S6EOtDiu2i2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 19 10:07:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=66.85.158.91, TLS: Connection closed, session=<WcRqIutD1MlHBobp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.40.130
country_id: 226074
description:
Nov 19 10:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=196.0.40.130, lip=66.85.158.91, TLS, session=<9G7RKOtDF4PEACiC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.211.108
country_id: 3865483
description:
Nov 19 10:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.1.211.108, lip=66.85.158.91, TLS, session=</JcjKutDNpa6AdNs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:09:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS, session=<Gy2WKetDPP2i2Jb5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:10:37 host2 sshd[78432]: Disconnected from invalid user peter 178.128.147.10 port 34710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:11:06 host2 sshd[78822]: Disconnected from invalid user trial 45.81.23.80 port 32906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:14:37 host2 sshd[81201]: Disconnected from invalid user alexis 178.128.147.10 port 37584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.233
country_id: 6252001
description:
Nov 19 10:14:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fPajPetDO8TG6xjp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:15:52 host2 sshd[82023]: Disconnected from invalid user server 45.81.23.80 port 53348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 19 10:16:50 host2 sshd[82738]: Disconnected from invalid user jona 165.154.1.18 port 56166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:18:07 host2 sshd[83390]: Disconnected from invalid user ca 86.107.77.91 port 40432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:18:08 host2 sshd[83400]: Disconnected from invalid user vpsuser 178.128.147.10 port 35150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-19 10:19:01 dovecot_plain authenticator failed for (prowns) [94.204.236.202]:51310: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:19:12 host2 sshd[84004]: Disconnected from invalid user admin2 178.128.147.10 port 53664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:20:14 host2 sshd[84913]: Disconnected from invalid user backup 86.107.77.91 port 37376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:21:58 host2 sshd[85939]: Disconnected from invalid user mep 45.81.23.80 port 48036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:21:17 host2 sshd[85490]: Disconnected from invalid user user1 86.107.77.91 port 45252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 19 10:23:19 host2 sshd[86817]: Disconnected from invalid user user1 165.154.1.18 port 33238 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 19 10:25:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<MFoYY+tDEA1APsUR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.53
country_id: 953987
description:
Nov 19 10:26:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.41.53, lip=66.85.158.91, TLS, session=<cCJIZutDj7dmQCk1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov 19 10:26:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.241, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TJC7aOtDos3N0h/x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.239
country_id: 3865483
description:
Nov 19 10:26:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.177.200.239, lip=66.85.158.91, TLS, session=<4eSQZ+tDfL8tscjv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.59.91.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.59.91.71 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:36:33 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<v1ZKi+tDTtIDg9cm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.143.196.159
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.143.196.159 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.53.219.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 50.53.219.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.4.249.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.4.249.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.7.131.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.7.131.116 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.51.241.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.51.241.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.65.194
country_id: 1210997
description:
2025-11-19 10:37:30 dovecot_plain authenticator failed for ([31.57.166.48]) [103.112.65.194]:36120: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.159.105.190
country_id: 1733045
description:
2025-11-19 10:37:48 dovecot_plain authenticator failed for ([31.57.166.48]) [110.159.105.190]:51435: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:37:18 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<Hbf2jetDRq4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.235.19.215
country_id: 3469034
description:
2025-11-19 10:38:08 dovecot_plain authenticator failed for ([31.57.166.48]) [177.235.19.215]:34639: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:39:17 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<M4kLletDHoUDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.161
country_id: 3469034
description:
Nov 19 10:41:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=191.53.128.161, lip=66.85.158.91, TLS, session=<wbd8mutDRIC/NYCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:40:07 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<uGYJmOtD4qQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:41:32 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<mAAXnetDWJMDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.135
country_id: 3175395
description:
Nov 19 10:41:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=217.26.178.135, lip=66.85.158.91, TLS, session=<qFSmm+tDsr/ZGrKH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:41:26 host2 sshd[98784]: Disconnected from invalid user calvin 182.253.238.218 port 45509 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:43:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<LLXvpOtD3OUDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:43:58 host2 sshd[100337]: Disconnected from invalid user sql 182.253.238.218 port 38120 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:44:15 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=</AXSputDAsMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:44:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<emv1p+tDjNUDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Nov 19 10:45:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<biPMrOtD68TG6xjy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:46:29 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<mnPJrutDbNwDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.91
country_id: 3017382
description:
2025-11-19 10:46:44 dovecot_plain authenticator failed for ([10.22.18.159]) [203.188.183.91]:7519: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:47:11 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<xwVSsetDwooDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:48:21 host2 sshd[103401]: Disconnected from invalid user admin 182.253.238.218 port 53328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:49:46 host2 sshd[104181]: Disconnected from invalid user marcel 182.253.238.218 port 39568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:51:12 host2 sshd[105177]: Disconnected from invalid user ubuntu 182.253.238.218 port 54044 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov 19 10:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.91, session=<bfpww+tDjKel4z73>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:53:41 host2 sshd[106386]: Disconnected from invalid user abhishek 43.225.158.169 port 38158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-19 10:54:24 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:20217: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-19 10:54:46 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:50983: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.189.195
country_id: 1643084
description:
2025-11-19 10:55:13 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:42447: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:56:08 host2 sshd[108592]: Disconnected from invalid user admin 43.225.158.169 port 58122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:57:28 host2 sshd[109286]: Disconnected from invalid user botuser 43.225.158.169 port 43968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 19 10:59:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, TLS, session=<2GrF2+tDZocD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:01:22 host2 sshd[111413]: Disconnected from invalid user gerencia 50.225.176.238 port 50250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 11:03:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57257: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:04:48 host2 sshd[113794]: Disconnected from invalid user gp 50.225.176.238 port 33172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:07:11 host2 sshd[115404]: Disconnected from invalid user techuser 101.36.119.218 port 42298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:09:24 host2 sshd[116885]: Disconnected from invalid user techuser 50.225.176.238 port 50534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:12:00 host2 sshd[118845]: Disconnected from invalid user hossein 101.36.119.218 port 59582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:13:16 host2 sshd[120211]: Disconnected from invalid user kyu 50.225.176.238 port 41078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:16:59 host2 sshd[123343]: Disconnected from invalid user es 101.36.119.218 port 48234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:18:17 host2 sshd[124296]: Disconnected from invalid user testserver 101.36.119.218 port 47274 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 19 11:23:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<wmldNOxDiPenXpI7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Nov 19 11:30:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.40, lip=66.85.158.91, TLS, session=<mlBkS+xDKPTN0h8o>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 19 11:30:56 host2 pure-ftpd[134133]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 19 11:30:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS, session=</NjHTexDLpozn+p2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:31:50 host2 sshd[134809]: Disconnected from invalid user wl 103.101.225.22 port 49454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.237
country_id: 3865483
description:
Nov 19 11:32:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.122.128.237, lip=66.85.158.91, TLS, session=<qRZWUuxD5si+eoDt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.158
country_id: 3865483
description:
Nov 19 11:32:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.181.101.158, lip=66.85.158.91, TLS, session=<oF+8U+xDWsy+tWWe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.113
country_id: 2963597
description:
Nov 19 11:34:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=37.203.49.113, lip=66.85.158.91, TLS, session=<ain1V+xDDJslyzFx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.171
country_id: 3469034
description:
Nov 19 11:34:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=200.196.143.171, lip=66.85.158.91, TLS, session=<UL2lWexDIozIxI+r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.154
country_id: 6252001
description:
Nov 19 11:35:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.154, lip=66.85.158.92, TLS, session=<3yJrXexD3IEUQGia>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 19 11:35:57 host2 sshd[137096]: Disconnected from invalid user user 190.167.237.191 port 43314 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.16
country_id: 6252001
description:
Nov 19 11:36:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=742) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=40.124.175.16, lip=66.85.158.91, TLS: read(size=742) failed: Connection reset by peer, session=<Ez5TYexDPJ8ofK8Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.237
country_id: 6252001
description:
Nov 19 11:39:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.237, lip=66.85.158.92, session=<xk5YbOxDrM+H7X3t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 19 11:39:33 host2 sshd[139141]: Disconnected from invalid user discord 190.167.237.191 port 46810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Nov 19 11:40:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r9BabuxDG8XN0h/P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:40:20 host2 sshd[139739]: Disconnected from invalid user filezilla 103.101.225.22 port 33028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:40:07 host2 sshd[139525]: Disconnected from invalid user usr1cv8 27.254.149.199 port 52044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:41:39 host2 sshd[140592]: Disconnected from invalid user willem 103.101.225.22 port 45254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:43:03 host2 sshd[141390]: Disconnected from invalid user diego 103.101.225.22 port 58518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.104.209
country_id: 3469034
description:
Nov 19 11:45:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=191.240.104.209, lip=66.85.158.91, TLS, session=<PlCxgOxDo5S/8GjR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.43
country_id: 798544
description:
Nov 19 11:45:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training>, method=PLAIN, rip=91.246.213.43, lip=66.85.158.91, TLS, session=<W1HggexDEpxb9tUr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:46:25 host2 sshd[143847]: Disconnected from invalid user andy 27.254.149.199 port 50474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:47:46 host2 sshd[144683]: Disconnected from invalid user ftp1 27.254.149.199 port 52492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:47:52 host2 sshd[144731]: Disconnected from invalid user helene 103.101.225.22 port 48750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 19 11:50:04 host2 sshd[146045]: Disconnected from invalid user web 154.219.97.8 port 33722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:52:06 host2 sshd[147458]: Disconnected from invalid user manish 27.254.149.199 port 58570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 19 11:53:18 host2 sshd[148375]: Disconnected from invalid user admin 154.219.97.8 port 34208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 19 11:53:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, TLS handshaking: Connection closed, session=<apy1nuxDrl1ChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-11-19 11:55:22 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:42880: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.33.131
country_id: 3865483
description:
Nov 19 12:01:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.227.33.131, lip=66.85.158.91, TLS, session=<GEe7uOxDrcgt4yGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.185
country_id: 1269750
description:
Nov 19 12:01:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=103.18.166.185, lip=66.85.158.91, TLS, session=<85hQuuxD4rtnEqa5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.184.139
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.80.184.139 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.134
country_id: 6252001
description:
Nov 19 12:11:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.134, lip=66.85.158.92, TLS: Connection closed, session=<vTYT3+xDjJXHLZqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.180
country_id: 6252001
description:
Nov 19 12:21:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.180, lip=66.85.158.91, session=<c42YAe1D1OoUQcK0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:27:41 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<cvazGO1D3p0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.250.44
country_id: 2921044
description:
Nov 19 12:27:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.250.44, lip=66.85.158.92, TLS, session=<BPDfGO1DlmqkXPos>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:28:31 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<PMK9G+1DDKUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.151
country_id: 3469034
description:
Nov 19 12:29:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.247.151, lip=66.85.158.91, TLS, session=<QzzhHe1DYtm60feX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.222
country_id: 690791
description:
Nov 19 12:29:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=37.221.134.222, lip=66.85.158.91, TLS, session=<LwcfH+1Diqol3Ybe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:31:04 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<k4DaJO1DkOADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:31:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<6PtxJ+1DlIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:32:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<VBYLK+1DaroDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:32:59 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<9rCzK+1DjNYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:33:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<5u/ULe1DdtwDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:33:45 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<aj5wLu1D6MQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:34:16 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<KctJMO1DNugDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 12:35:46 host2 sshd[175843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 12:36:09 host2 sshd[176071]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 19 12:39:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<cWTAQu1DlLCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-19 12:40:53 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:33812: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-19 12:41:04 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:40274: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.228.125
country_id: 2245662
description:
Nov 19 12:41:50 host2 sshd[179545]: Disconnected from invalid user nrk 154.125.228.125 port 57384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.49
country_id: 3865483
description:
Nov 19 12:43:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.198.49, lip=66.85.158.91, TLS, session=<pgMET+1D1di14cYx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.50
country_id: 3175395
description:
Nov 19 12:43:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.208.106.50, lip=66.85.158.91, TLS, session=<7pwqUO1Dvey50Goy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.238
country_id: 3469034
description:
Nov 19 12:48:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.189.199.238, lip=66.85.158.91, TLS, session=<G+RNYu1DrY+zvcfu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.181
country_id: 690791
description:
Nov 19 12:49:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.158.181, lip=66.85.158.91, TLS, session=<xOceZO1DzZ4l3Z61>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 12:49:07 host2 sshd[184401]: Disconnected from invalid user apple 186.237.143.246 port 37904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.228.125
country_id: 2245662
description:
Nov 19 12:50:40 host2 sshd[185509]: Disconnected from invalid user login 154.125.228.125 port 37851 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 12:52:37 host2 sshd[186694]: Disconnected from invalid user ali 186.237.143.246 port 34328 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.73.204.62
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.73.204.62 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 13:01:36 host2 sshd[193409]: Disconnected from invalid user ac 186.237.143.246 port 52824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 19 13:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<Akexme1D4NgsyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 13:08:29 host2 sshd[197721]: Disconnected from invalid user vscode 186.237.143.246 port 36930 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.227
country_id: 2635167
description:
Nov 19 13:08:34 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.227, lip=66.85.158.91, TLS, session=<1cnqqu1Dk9+594nj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-19 13:14:41 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46676: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-19 13:14:48 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:34521: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 19 13:22:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yxKb2+1DSjhAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.55
country_id: 6252001
description:
Nov 19 13:22:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.55, lip=66.85.158.91, session=<iRm82+1DsTxAPpw3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.52
country_id: 6252001
description:
Nov 19 13:22:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.52, lip=66.85.158.91, TLS: Connection closed, session=<9Al03O1D4DFAPpw0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-11-19 13:24:47 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:55355: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-19 13:25:17 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:43640: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-19 13:25:19 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:52586: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-19 13:25:46 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:60348: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:33:28 host2 sshd[213238]: Disconnected from invalid user hp 152.32.174.199 port 38682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 19 13:35:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, TLS: Connection closed, session=<IJqmDO5DgMrCpGsE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:35:55 host2 sshd[215175]: Disconnected from invalid user postgres 152.32.174.199 port 41220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.117
country_id: 3175395
description:
Nov 19 13:39:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.15.171.117, lip=66.85.158.91, TLS, session=<IRqtF+5DOeq5D6t1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.41
country_id: 3865483
description:
Nov 19 13:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.193.41, lip=66.85.158.91, TLS, session=<vSTSGO5D9Nm6YMEp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.185
country_id: 3469034
description:
Nov 19 13:41:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.89.136.185, lip=66.85.158.91, TLS, session=<pQ4LHu5D19y+WYi5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:40:53 host2 sshd[218433]: Disconnected from invalid user user2 152.32.174.199 port 38856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.23
country_id: 798544
description:
Nov 19 13:41:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=91.246.105.23, lip=66.85.158.91, TLS, session=<lA8xH+5D6eJb9mkX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:43:40 host2 sshd[219973]: Disconnected from invalid user deleteme 200.118.99.170 port 54942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:46:08 host2 sshd[222026]: Disconnected from invalid user pentest 200.118.99.170 port 53804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:47:22 host2 sshd[222860]: Disconnected from invalid user gokul 200.118.99.170 port 53234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:49:45 host2 sshd[224218]: Disconnected from invalid user monika 200.118.99.170 port 52090 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Nov 19 13:57:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.91, session=<2EVkWe5D0ubG6xh2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 19 14:02:46 host2 sshd[233063]: Disconnected from invalid user cmm 162.241.87.197 port 37112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 19 14:05:45 host2 sshd[235462]: Disconnected from invalid user arif 162.241.87.197 port 53032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-19 14:07:23 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:39064: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-19 14:07:32 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:55441: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.91
country_id: 798544
description:
Nov 19 14:08:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=46.20.58.91, lip=66.85.158.91, TLS, session=<KiGIfu5DVMEuFDpb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.28
country_id: 1269750
description:
Nov 19 14:08:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.104.127.28, lip=66.85.158.91, TLS, session=<q0+rf+5DPuZnaH8c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 19 14:08:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.92, TLS, session=<hKARge5Dgu3G6xhl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 19 14:11:42 host2 sshd[239130]: Disconnected from invalid user db 103.49.239.77 port 40824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.72
country_id: 1643084
description:
Nov 19 14:11:59 host2 sshd[239292]: Disconnected from invalid user tarsys 103.146.203.72 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:12:07 host2 sshd[239396]: Disconnected from invalid user julien 152.32.239.90 port 17146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.125.229
country_id: 6252001
description:
Nov 19 14:12:23 host2 pure-ftpd[239592]: (?@134.122.125.229) [INFO] New connection from 134.122.125.229


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 19 14:13:14 host2 sshd[240202]: Disconnected from invalid user ssd 103.49.239.77 port 40248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.72
country_id: 1643084
description:
Nov 19 14:13:18 host2 sshd[240237]: Disconnected from invalid user ssd 103.146.203.72 port 50008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:13:29 host2 sshd[240316]: Disconnected from invalid user l4d2 152.32.239.90 port 45434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:19:52 host2 sshd[244652]: Disconnected from invalid user ubuntu 152.32.239.90 port 21868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:22:33 host2 sshd[246500]: Disconnected from invalid user web 117.252.95.54 port 46878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:23:44 host2 sshd[247334]: Disconnected from invalid user ftpuser 165.154.170.25 port 52582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:24:06 host2 sshd[247593]: Disconnected from invalid user librenms 117.252.95.54 port 59192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.222.53
country_id: 1880251
description:
Nov 19 14:24:41 host2 sshd[247993]: Disconnected from invalid user ryan 152.42.222.53 port 37164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:27:50 host2 sshd[250333]: Disconnected from invalid user seekcy 165.154.170.25 port 57352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.222.53
country_id: 1880251
description:
Nov 19 14:28:59 host2 sshd[251136]: Disconnected from invalid user palserver 152.42.222.53 port 38688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:28:42 host2 sshd[250995]: Disconnected from invalid user ubuntu 117.252.95.54 port 64402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:30:07 host2 sshd[251992]: Disconnected from invalid user dos 117.252.95.54 port 8346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:30:32 host2 sshd[252283]: Disconnected from invalid user ftptest2 165.154.170.25 port 37534 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 14:31:51 host2 sshd[253126]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.252
country_id: 6252001
description:
Nov 19 14:32:02 host2 pure-ftpd[253270]: (?@184.105.247.252) [INFO] New connection from 184.105.247.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 14:32:14 host2 sshd[253412]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:32:56 host2 sshd[253898]: Disconnected from invalid user usuario1 117.252.95.54 port 28637 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:37:23 host2 sshd[256743]: Disconnected from invalid user lighthouse 165.154.170.25 port 41646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.38
country_id: 298795
description:
Nov 19 14:40:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=95.0.171.38, lip=66.85.158.91, TLS, session=<dfHH8+5D0ctfAKsm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.121
country_id: 3175395
description:
Nov 19 14:40:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.197.9.121, lip=66.85.158.91, TLS, session=<716o8u5DAq+5xQl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-19 14:44:38 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:55770: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.111
country_id: 3469034
description:
Nov 19 14:45:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=186.216.88.111, lip=66.85.158.91, TLS, session=<5bGvAu9DNp262Fhv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.244
country_id: 798544
description:
Nov 19 14:45:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.20.58.244, lip=66.85.158.91, TLS, session=<j+7wA+9D0Z8uFDr0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 14:57:23 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60908: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 19 15:04:11 host2 sshd[274926]: Disconnected from invalid user gino 167.71.204.253 port 36712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Nov 19 15:05:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<+D3QTO9DVoc26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.88
country_id: 6252001
description:
Nov 19 15:05:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.88, lip=66.85.158.92, session=<csYuTu9D/+HDuExY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.133
country_id: 6252001
description:
Nov 19 15:05:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.133, lip=66.85.158.92, session=<kJjJTu9DCdPDuEyF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.135
country_id: 6252001
description:
Nov 19 15:06:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.135, lip=66.85.158.92, session=<FEZxT+9DKZPDuEyH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.26.161
country_id: 798544
description:
Nov 19 15:06:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.216.26.161, lip=66.85.158.91, TLS, session=<VBI4Ue9DFrKy2Bqh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.82
country_id: 1269750
description:
Nov 19 15:07:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.18.166.82, lip=66.85.158.91, TLS, session=<24BeUu9DU65nEqZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:08:32 host2 sshd[277642]: Disconnected from invalid user wangjian 87.120.219.216 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:10:29 host2 sshd[278886]: Disconnected from invalid user andrew 87.120.219.216 port 41742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 19 15:10:51 host2 sshd[279137]: Disconnected from invalid user postgres 167.71.204.253 port 41266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:14:24 host2 sshd[281981]: Disconnected from invalid user postgres 87.120.219.216 port 43592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-19 15:26:00 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:50188: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-19 15:27:00 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:53026: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-19 15:26:33 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:55396: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.250.2
country_id: 99237
description:
Nov 19 15:35:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=65.20.250.2, lip=66.85.158.91, TLS, session=<FXylte9Dw9xBFPoC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.239.103.137
country_id: 3277605
description:
Nov 19 15:35:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=104.239.103.137, lip=66.85.158.91, TLS, session=<KmHNtu9Dt8xo72eJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:36:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<b8PFuu9D3owDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:37:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<feYfwe9DHOoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:39:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<uwVqxe9DFK4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:40:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<8bp8y+9DwKkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:42:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<G6YE0u9DqLEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 19 15:43:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=</2z70+9Dps4s3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:43:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</YP60+9DjJ0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-19 15:44:57 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:57525: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-19 15:44:40 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:58451: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:45:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<+Xpo3O9DAMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 19 15:52:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<YK2v9O9D7s02xDDo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:08:36 host2 sshd[322731]: Disconnected from invalid user nam 79.116.35.29 port 33904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:11:57 host2 sshd[325233]: Disconnected from invalid user elasticsearch 79.116.35.29 port 42594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:13:11 host2 sshd[325975]: Disconnected from invalid user ubuntu 79.116.35.29 port 42134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:17:15 host2 sshd[328647]: Disconnected from invalid user gabby 103.59.95.12 port 41724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:17:43 host2 sshd[328915]: Disconnected from invalid user maman 79.116.35.29 port 40292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.247
country_id: 3469034
description:
Nov 19 16:20:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.53.165.247, lip=66.85.158.91, TLS, session=<uvAWWfBDrtSxNaX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.247
country_id: 3175395
description:
Nov 19 16:21:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=171.22.235.247, lip=66.85.158.91, TLS, session=<PaZWWvBDoM6rFuv3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.32.16
country_id: 3017382
description:
Nov 19 16:21:33 host2 sshd[331312]: Disconnected from invalid user goran 146.59.32.16 port 35960 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 16:26:56 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.32.16
country_id: 3017382
description:
Nov 19 16:27:04 host2 sshd[335049]: Disconnected from invalid user client 146.59.32.16 port 36570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 16:27:34 host2 sshd[335341]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:29:17 host2 sshd[336326]: Disconnected from invalid user frontend 103.59.95.12 port 44778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.47
country_id: 798544
description:
Nov 19 16:30:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.228.33.47, lip=66.85.158.91, TLS, session=<hHy6evBDZoxb5CEv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.111.248
country_id: 3469034
description:
Nov 19 16:30:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.85.111.248, lip=66.85.158.91, TLS, session=<pQ/Ve/BDpN67VW/4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.2
country_id: 3017382
description:
Nov 19 16:31:01 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.2, lip=66.85.158.92, session=<GgPufvBDtcRb51kC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.106
country_id: 3017382
description:
Nov 19 16:31:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.106, lip=66.85.158.92, session=<skUgf/BDv+Nb51lq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.7
country_id: 3017382
description:
Nov 19 16:30:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.7, lip=66.85.158.92, session=</hpjffBDW9Nb51kH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:33:18 host2 sshd[338945]: Disconnected from invalid user ali 160.187.210.95 port 46232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:34:43 host2 sshd[339755]: Disconnected from invalid user admin 103.59.95.12 port 38912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:36:34 host2 sshd[341357]: Disconnected from invalid user nw 27.112.78.223 port 50436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:38:21 host2 sshd[342359]: Disconnected from invalid user goran 103.59.95.12 port 33558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:39:05 host2 sshd[342789]: Disconnected from invalid user milad 27.112.78.223 port 60236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-19 16:40:22 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:53892: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:40:41 host2 sshd[344079]: Disconnected from invalid user milad 160.187.210.95 port 58532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:42:06 host2 sshd[345131]: Disconnected from invalid user little 160.187.210.95 port 33744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:42:47 host2 sshd[345600]: Disconnected from invalid user deploy 27.112.78.223 port 50208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:43:28 host2 sshd[346063]: Disconnected from invalid user gerrit 160.187.210.95 port 44964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:43:39 host2 sshd[346174]: Disconnected from invalid user administrator 198.98.56.205 port 51426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:44:54 host2 sshd[347402]: Disconnected from invalid user lc 160.187.210.95 port 37228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 19 16:45:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, TLS: Connection closed, session=<UFRos/BDmuKUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:45:59 host2 sshd[348315]: Disconnected from invalid user mp 198.98.56.205 port 57270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.57
country_id: 6251999
description:
Nov 19 16:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.57, lip=66.85.158.91, session=<1OELv/BDaqqUccE5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:52:25 host2 sshd[352297]: Disconnected from invalid user gabriele 198.98.56.205 port 35156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:55:32 host2 sshd[355050]: Disconnected from invalid user udin 198.98.56.205 port 53650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
country_id: 6252001
description:
2025-11-19 16:57:49 dovecot_login authenticator failed for ([74.203.86.207]) [74.203.86.207]:60789: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-19 16:58:03 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:48107: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Nov 19 17:00:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<UP+f5vBDZn4tIVDz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Nov 19 17:00:11 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, TLS, session=<4fFA5/BD3C6saAsu>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-19 17:05:21 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (favoripoon) [73.88.196.91]:60332: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-19 17:05:40 H=([92.246.87.86]) [92.246.87.86]:53618 F=<info@roc-tech.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-19 17:08:00 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:57402: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-11-19 17:08:27 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:45648: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-19 17:08:55 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:42142: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:19:48 host2 sshd[372586]: Disconnected from invalid user ubuntu 165.154.200.14 port 33144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 19 17:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<W4oLMvFD4uMjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:21:26 host2 sshd[373679]: Disconnected from invalid user ubuntu 43.160.251.55 port 59634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:22:49 host2 sshd[374431]: Disconnected from invalid user user01 79.106.73.114 port 40304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:24:24 host2 sshd[375271]: Disconnected from invalid user moodle 68.183.46.135 port 32886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:24:28 host2 sshd[375293]: Disconnected from invalid user dspace 159.253.36.117 port 55390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:24:32 host2 sshd[375319]: Disconnected from invalid user fengyun 43.160.251.55 port 46244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.18
country_id: 1269750
description:
Nov 19 17:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=103.207.4.18, lip=66.85.158.91, TLS, session=<U75DQfFDLJtnzwQS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.92.68.200
country_id: 732800
description:
Nov 19 17:25:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.92.68.200, lip=66.85.158.91, TLS, session=<5VaNQvFDIQhbXETI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:28:00 host2 sshd[377537]: Disconnected from invalid user eddie 79.106.73.114 port 35986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:28:26 host2 sshd[377787]: Disconnected from invalid user user 43.160.251.55 port 34160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:29:13 host2 sshd[378252]: Disconnected from invalid user hydra 79.106.73.114 port 45942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:29:17 host2 sshd[378279]: Disconnected from invalid user moodle 159.253.36.117 port 43674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:28:31 host2 sshd[377818]: Disconnected from invalid user ubuntu 68.183.46.135 port 33512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:30:26 host2 sshd[379146]: Disconnected from invalid user hydra 159.253.36.117 port 41198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:30:35 host2 sshd[379334]: Disconnected from invalid user user 68.183.46.135 port 48712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 19 17:32:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0zGFWfFDGK1ChJlx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:31:31 host2 sshd[379870]: Disconnected from invalid user ubuntu 159.253.36.117 port 54158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.136
country_id: 1269750
description:
2025-11-19 17:31:41 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.136]:42372: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-11-19 17:32:00 dovecot_login authenticator failed for (31-154-88-51.orange.net.il) [2.55.88.51]:44289: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.85
country_id: 3469034
description:
Nov 19 17:33:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=191.53.40.85, lip=66.85.158.91, TLS, session=<OGy+W/FD8r6/NShV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.8
country_id: 3469034
description:
Nov 19 17:32:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=191.53.40.8, lip=66.85.158.91, TLS, session=<02N1WvFD59e/NSgI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:33:34 host2 sshd[380870]: Disconnected from invalid user dspace 68.183.46.135 port 43892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 17:34:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YfmAY/FDIpvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:35:09 host2 sshd[381851]: Disconnected from invalid user admin 165.154.200.14 port 59800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:37:28 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:61459: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:37:34 dovecot_login authenticator failed for ([103.17.193.137]) [103.17.193.137]:61459: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:40:07 host2 sshd[385228]: Disconnected from invalid user ubuntu 43.160.251.55 port 53484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 17:40:36 host2 sshd[385555]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:40:38 host2 sshd[385582]: Disconnected from invalid user gerrit 165.154.200.14 port 56056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-19 17:41:12 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:43096: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-19 17:41:25 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:57582: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:42:28 host2 sshd[386640]: Disconnected from invalid user hydra 165.154.200.14 port 58916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 19 17:42:47 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<VNmef/FDANUD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 17:43:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=</nLOgPFDNKzPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:46:22 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:58722: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.38.169
country_id: 953987
description:
Nov 19 17:47:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.38.169, lip=66.85.158.91, TLS, session=<1pplkPFD06RmQCap>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.117.50
country_id: 3175395
description:
Nov 19 17:48:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.238.117.50, lip=66.85.158.91, TLS, session=<3o/HkfFDVIxb7nUy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-19 17:50:14 dovecot_plain authenticator failed for (heeis) [65.20.143.159]:56164: 535 Incorrect authentication data (set_id=contato@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:51:59 host2 sshd[393594]: Disconnected from invalid user dspace 43.160.251.55 port 46708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:55:43 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:52276: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:58:32 dovecot_login authenticator failed for ([103.17.193.137]) [103.17.193.137]:52276: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.50
country_id: 6252001
description:
Nov 19 18:09:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.80.105.50, lip=66.85.158.91, TLS, session=<96UD3/FDBqAUUGky>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-19 18:09:48 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (aralsheod) [174.161.27.82]:33995: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-19 18:14:08 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:35336: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-19 18:13:24 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:58320: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 18:23:42 host2 sshd[416244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 19 18:26:56 host2 sshd[418176]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 58805


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.69.10.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.69.10.175 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:34:16 host2 sshd[422234]: Disconnected from invalid user tuan 167.99.78.165 port 46858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.97.110
country_id: 6252001
description:
Nov 19 18:34:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.211.97.110, lip=66.85.158.91, session=<iRfkOPJDapLG02Fu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 18:35:08 host2 sshd[422848]: Disconnected from invalid user sshtunnel 45.78.202.58 port 47970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:35:49 host2 sshd[423139]: Disconnected from invalid user rundeck 118.139.164.171 port 42954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.97.110
country_id: 6252001
description:
Nov 19 18:35:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.211.97.110, lip=66.85.158.92, session=<7RRiPfJDdt/G02Fu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:37:08 host2 sshd[423983]: Disconnected from invalid user deploy 51.83.71.110 port 59316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:37:15 host2 sshd[424031]: Disconnected from invalid user hundsun 27.111.32.174 port 37988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.197
country_id: 3175395
description:
Nov 19 18:36:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.171.197, lip=66.85.158.91, TLS, session=<iBk9PvJDR6u5D6vF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.124.79.130
country_id: 732800
description:
Nov 19 18:36:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=188.124.79.130, lip=66.85.158.91, TLS, session=<OrhYP/JDw9y8fE+C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Nov 19 18:37:16 host2 sshd[424041]: Disconnected from invalid user mario 202.70.65.229 port 42020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.80
country_id: 3469034
description:
Nov 19 18:37:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=191.53.131.80, lip=66.85.158.91, TLS, session=<vynaQ/JD3qS/NYNQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-19 18:38:01 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (throte) [87.103.126.54]:51785: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:38:59 host2 sshd[424830]: Disconnected from invalid user admin 118.139.164.171 port 35140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.236
country_id: 3469034
description:
Nov 19 18:38:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.199.236, lip=66.85.158.91, TLS, session=<zNoiRfJD0Mmzvcfs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:40:33 host2 sshd[425771]: Disconnected from invalid user ubuntu 118.139.164.171 port 49096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:41:39 host2 sshd[426182]: Disconnected from invalid user eddie 103.127.242.211 port 48526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:41:54 host2 sshd[426374]: Disconnected from invalid user sagar 167.99.78.165 port 57102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.225.226.106
country_id: 690791
description:
Nov 19 18:43:07 host2 sshd[426955]: Disconnected from invalid user deploy 185.225.226.106 port 37012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:43:16 host2 sshd[427040]: Disconnected from invalid user max 167.99.78.165 port 54008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:42:32 host2 sshd[426696]: Disconnected from invalid user gl 51.83.71.110 port 39242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:43:28 host2 sshd[427137]: Disconnected from invalid user rundeck 165.227.3.79 port 42553 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:43:47 host2 sshd[427249]: Disconnected from invalid user sftpuser 51.83.71.110 port 40984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:44:52 host2 sshd[428052]: Disconnected from invalid user payara 165.227.3.79 port 57737 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:45:04 host2 sshd[428265]: Disconnected from invalid user jumpserver 51.83.71.110 port 43764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:46:03 host2 sshd[429123]: Disconnected from invalid user koha 167.99.78.165 port 53578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:46:26 host2 sshd[429392]: Disconnected from invalid user validation 118.139.164.171 port 53854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.67
country_id: 3865483
description:
Nov 19 18:46:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=181.225.195.67, lip=66.85.158.91, TLS, session=<hRPbYvJDN8y14cND>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.154
country_id: 3175395
description:
Nov 19 18:46:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=217.26.179.154, lip=66.85.158.91, TLS, session=<qWj9Y/JDScbZGrOa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:46:20 host2 sshd[429357]: Disconnected from invalid user ubuntu 51.83.71.110 port 37992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:47:30 host2 sshd[430000]: Disconnected from invalid user simon 27.111.32.174 port 37078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:47:42 host2 sshd[430113]: Disconnected from invalid user habib 165.227.3.79 port 59889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:48:20 host2 sshd[430566]: Disconnected from invalid user julian 103.127.242.211 port 36806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 19 18:48:25 host2 sshd[430645]: Disconnected from invalid user test3 51.91.98.128 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 18:49:28 host2 sshd[431027]: Disconnected from invalid user tuan 45.78.205.93 port 50938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:49:44 host2 sshd[431591]: Disconnected from invalid user morteza 103.127.242.211 port 60868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.225.226.106
country_id: 690791
description:
Nov 19 18:49:56 host2 sshd[431691]: Disconnected from invalid user webuser 185.225.226.106 port 39688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 19 18:50:29 host2 sshd[432374]: Disconnected from invalid user webuser 51.91.98.128 port 40590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:51:59 host2 sshd[433101]: Disconnected from invalid user test3 27.111.32.174 port 54334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 18:53:59 host2 sshd[434289]: Disconnected from invalid user aryan 45.78.205.93 port 44490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-19 18:57:56 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:41752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-19 18:58:52 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:45848: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-19 18:58:23 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:49674: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 19:01:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54082: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 19:01:53 host2 sshd[439768]: Disconnected from invalid user jumpserver 45.78.202.58 port 37566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 19 19:03:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<LnuInvJDYiRChJlx>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-19 19:14:05 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:58944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-11-19 19:13:43 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:40467: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.252
country_id: 3865483
description:
Nov 19 19:16:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.177.200.252, lip=66.85.158.91, TLS, session=<tfs7z/JDRqQtscj8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.128.35
country_id: 732800
description:
Nov 19 19:16:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=77.76.128.35, lip=66.85.158.91, TLS, session=<nRg4zfJDct9NTIAj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.117.35.32
country_id: 798544
description:
Nov 19 19:16:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=195.117.35.32, lip=66.85.158.91, TLS, session=<YGxJzvJDpgrDdSMg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.212.202
country_id: 99237
description:
Nov 19 19:17:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.212.202, lip=66.85.158.91, TLS, session=<aoRs0PJD+J9BFNTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 19:20:52 host2 sshd[456197]: Disconnected from invalid user debian 45.78.205.93 port 52818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 19:21:50 host2 sshd[456710]: Disconnected from invalid user sftpuser 45.78.202.58 port 52588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 19:25:48 host2 sshd[459808]: Disconnected from invalid user koha 45.78.205.93 port 40736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 19 19:31:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<eGDkBPNDDNcjygmF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 19 19:32:24 host2 pure-ftpd[464034]: (?@66.132.153.118) [INFO] New connection from 66.132.153.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 19 19:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS: Connection closed, session=<Y7NPP/ND1qQz3piW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 19:48:17 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.214
country_id: 1269750
description:
Nov 19 19:51:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.30.83.214, lip=66.85.158.91, TLS, session=<ym33SfNDUt1nHlPW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.71
country_id: 3175395
description:
Nov 19 19:51:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.8.71, lip=66.85.158.91, TLS, session=<j/1dS/NDSpS5xQhH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 19:52:46 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.125.229
country_id: 6252001
description:
Nov 19 20:01:12 host2 pure-ftpd[486686]: (?@134.122.125.229) [INFO] New connection from 134.122.125.229


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6khAg/ND39ii2JVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:07:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<kb5BhPNDTO2i2JVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:12:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS, session=<SxWOlfNDKuui2JVq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 20:20:43 host2 sshd[500605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.236
country_id: 6252001
description:
Nov 19 20:22:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.236, lip=66.85.158.92, session=<uuZYuvND1b5APsXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Nov 19 20:22:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS: Connection closed, session=<coIeu/NDZNJAPsXj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.56
country_id: 6252001
description:
Nov 19 20:22:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.56, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gTkXu/NDKXpAPsU4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Nov 19 20:22:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<T+EpvPND+INAPsUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:29:36 host2 sshd[506864]: Disconnected from invalid user staging 203.129.217.73 port 59076 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:31:03 host2 sshd[507807]: Disconnected from invalid user admin 203.129.217.73 port 49608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:32:25 host2 sshd[508487]: Disconnected from invalid user amir 203.129.217.73 port 53204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.147
country_id: 953987
description:
Nov 19 20:33:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.41.147, lip=66.85.158.91, TLS, session=<Zo0s4vND+6dmQCmT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 20:33:22 host2 pure-ftpd[509108]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.170
country_id: 3175395
description:
Nov 19 20:33:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=178.239.35.170, lip=66.85.158.91, TLS, session=<KFwD4fNDo7Ky7yOq>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 20:33:36 host2 pure-ftpd[509367]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.139
country_id: 798544
description:
Nov 19 20:35:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.216.31.139, lip=66.85.158.91, TLS, session=<zODh5vNDnrmy2B+L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.228
country_id: 953987
description:
Nov 19 20:35:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=102.64.47.228, lip=66.85.158.91, TLS, session=<+A8J6PNDubBmQC/k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:41:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H0Cr//NDos6TuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:42:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4xDJAvRD1PuTuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:43:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<4VCzBPRDzPWTuYUw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 20:46:12 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:49:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS, session=<4UzTG/RDYOqTuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:50:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS, session=<wTdPHvRDbviTuYUw>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:01:25 host2 sshd[528664]: Disconnected from invalid user aaa 190.167.75.90 port 58052 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 21:01:46 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.96
country_id: 953987
description:
Nov 19 21:03:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=102.129.53.96, lip=66.85.158.91, TLS, session=<5ZTWSvRD3bNmgTVg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 21:04:07 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.101
country_id: 690791
description:
Nov 19 21:03:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.101, lip=66.85.158.91, TLS, session=<I+0FTPRDTZLCLIxl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:09:08 host2 sshd[535299]: Disconnected from invalid user test3 190.167.75.90 port 38186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:12:19 host2 sshd[537964]: Disconnected from invalid user socksuser 190.167.75.90 port 54352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:15:17 host2 sshd[540440]: Disconnected from invalid user en 190.167.75.90 port 42288 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 21:21:21 host2 sshd[544509]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:21:18 host2 sshd[545068]: Disconnected from invalid user es 174.84.246.11 port 46258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:23:55 host2 sshd[546614]: Disconnected from invalid user marco 174.84.246.11 port 47514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.248
country_id: 3469034
description:
Nov 19 21:23:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.8.251.248, lip=66.85.158.91, TLS, session=<wl6ClfRD1+SxCPv4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.198
country_id: 3865483
description:
Nov 19 21:25:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.101.198, lip=66.85.158.91, TLS, session=<xohnmfRDLdy+tWXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.67
country_id: 3469034
description:
Nov 19 21:24:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=138.36.202.67, lip=66.85.158.91, TLS, session=<Iy3LlvRDrLiKJMpD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:24:51 host2 sshd[547102]: Disconnected from invalid user ftp_user 190.167.75.90 port 34337 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.13
country_id: 933860
description:
Nov 19 21:25:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 31 secs): user=<info>, method=PLAIN, rip=41.216.213.13, lip=66.85.158.91, TLS, session=<Q6G1mvRDnt4p2NUN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:26:26 host2 sshd[548247]: Disconnected from invalid user ubuntu 174.84.246.11 port 48758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:26:47 host2 sshd[548386]: Disconnected from invalid user es 216.158.226.77 port 43102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:31:30 host2 sshd[550891]: Disconnected from invalid user ubuntu 174.84.246.11 port 51236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:33:17 host2 sshd[551805]: Disconnected from invalid user systemd 216.158.226.77 port 47882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:35:45 host2 sshd[554720]: Disconnected from invalid user odoo17 216.158.226.77 port 34950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:36:46 host2 sshd[555448]: Disconnected from invalid user marko 174.84.246.11 port 53738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:36:58 host2 sshd[555735]: Disconnected from invalid user paolo 216.158.226.77 port 59034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.212
country_id: 953987
description:
Nov 19 21:38:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.62.212, lip=66.85.158.91, TLS, session=<92i4x/RDd4BmgT7U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.151
country_id: 3469034
description:
Nov 19 21:37:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.209.247.151, lip=66.85.158.91, TLS, session=<4wlTxvRDBd260feX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:38:10 host2 sshd[560320]: Disconnected from invalid user snort 216.158.226.77 port 49094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-19 21:38:31 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:42964: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 21:39:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r1f1zvRDtKBChJmN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.160.125.236
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 217.160.125.236 - v-deploycom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user v-deploycom (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:50:45 host2 sshd[584004]: Disconnected from invalid user student2 151.46.175.94 port 21559 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:51:36 host2 sshd[585020]: Disconnected from invalid user ftp_id 151.43.127.92 port 59806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:53:47 host2 sshd[598649]: Disconnected from invalid user school 151.43.127.92 port 59550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:56:42 host2 sshd[602002]: Disconnected from invalid user hadoop 151.46.175.94 port 21207 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:57:59 host2 sshd[602965]: Disconnected from invalid user developer 151.46.175.94 port 21471 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 21:59:07 host2 sshd[603752]: Disconnected from invalid user red 154.9.249.104 port 44396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:59:44 host2 sshd[604126]: Disconnected from invalid user hossein 151.43.127.92 port 59580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:01:18 host2 sshd[605376]: Disconnected from invalid user hussein 40.115.18.231 port 39132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:03:23 host2 sshd[607617]: Disconnected from invalid user admin 102.204.206.49 port 54922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:02:38 host2 sshd[606373]: Disconnected from invalid user admin 40.115.18.231 port 41928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:03:53 host2 sshd[608073]: Disconnected from invalid user admin 40.115.18.231 port 44702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 22:04:52 host2 sshd[608734]: Disconnected from invalid user gf 154.9.249.104 port 52198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 22:05:37 host2 sshd[609430]: Disconnected from invalid user jorge 151.43.127.92 port 59474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 22:05:55 host2 sshd[609644]: Disconnected from invalid user roman 154.9.249.104 port 50900 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 22:06:47 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<2hPBL/VDRLXPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 22:06:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<6cvRL/VDYLXPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:09:34 host2 sshd[612708]: Disconnected from invalid user init 150.5.169.138 port 52270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.12
country_id: 6252001
description:
Nov 19 22:09:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.12, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7XtAOvVDE69BMQEM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.10
country_id: 6252001
description:
Nov 19 22:10:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.10, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dn5RO/VDGiFBMQEK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:10:42 host2 sshd[613770]: Disconnected from invalid user server 102.204.206.49 port 55348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.74
country_id: 3017382
description:
Nov 19 22:11:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.74, lip=66.85.158.91, session=<yxpMP/VDCaFbxJhK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 19 22:11:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, session=<P6f/P/VDOdpbxJhN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:12:16 host2 sshd[614900]: Disconnected from invalid user mike 150.5.169.138 port 45442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 19 22:11:35 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, session=<1HLmQPVDQ8hbxJhN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 22:12:48 host2 sshd[615355]: Disconnected from invalid user tata 151.46.175.94 port 21990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:14:09 host2 sshd[616377]: Disconnected from invalid user maksym 51.68.141.174 port 34676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:14:11 host2 sshd[616400]: Disconnected from invalid user knu 50.28.107.101 port 40086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:15:54 host2 sshd[617729]: Disconnected from invalid user cc 51.68.141.174 port 36246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:17:03 host2 sshd[618442]: Disconnected from invalid user atl 51.68.141.174 port 42514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Nov 19 22:17:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.231, lip=66.85.158.91, session=<uAOlVPVDBZlb5qjn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.100
country_id: 6252001
description:
Nov 19 22:17:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.100, lip=66.85.158.91, session=<1vwRVvVDU6Rb5qhk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.98
country_id: 6252001
description:
Nov 19 22:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.98, lip=66.85.158.91, session=<sPFAVvVDI+Vb5qhi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:17:37 host2 sshd[618972]: Disconnected from invalid user server 150.5.169.138 port 54312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:18:30 host2 sshd[619574]: Disconnected from invalid user mike 102.204.206.49 port 43796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:19:17 host2 sshd[620146]: Disconnected from invalid user ubuntu 50.28.107.101 port 57578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:20:26 host2 sshd[621032]: Disconnected from invalid user max 140.238.15.104 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:19:49 host2 sshd[620412]: Disconnected from invalid user git 102.204.206.49 port 51086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:20:11 host2 sshd[620795]: Disconnected from invalid user ansible 150.5.169.138 port 60270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-19 22:21:17 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:52170: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:21:27 host2 sshd[621651]: Disconnected from invalid user suman 51.68.141.174 port 40316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-19 22:21:30 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:28664: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:21:53 host2 sshd[621918]: Disconnected from invalid user test 50.28.107.101 port 35460 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.227.226.218
country_id: 6252001
description:
Nov 19 22:25:27 host2 pure-ftpd[624286]: (?@54.227.226.218) [INFO] New connection from 54.227.226.218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:29:02 host2 sshd[626102]: Disconnected from invalid user mike 140.238.15.104 port 44796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Nov 19 22:32:08 host2 sshd[628009]: Disconnected from invalid user user2 103.26.136.173 port 48616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 19 22:33:13 host2 sshd[628452]: Disconnected from invalid user pvx 107.189.29.175 port 34816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 19 22:35:34 host2 sshd[629526]: Disconnected from invalid user juan 107.189.29.175 port 59370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Nov 19 22:36:51 host2 sshd[629987]: Disconnected from invalid user ts3 103.26.136.173 port 59408 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 19 22:38:57 host2 pure-ftpd[630860]: (?@198.235.24.171) [INFO] New connection from 198.235.24.171


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 22:45:20 host2 sshd[634162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 22:45:43 host2 sshd[634384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.186
country_id: 3469034
description:
Nov 19 22:46:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=186.209.246.186, lip=66.85.158.91, TLS, session=<NOi6u/VDJpW60fa6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-19 22:46:16 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:47482: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.55
country_id: 3469034
description:
Nov 19 22:45:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.39.32.55, lip=66.85.158.91, TLS, session=</iltuvVDFruxJyA3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-19 22:46:38 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:60106: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 22:51:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.155.93
country_id: 99237
description:
Nov 19 22:53:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.155.93, lip=66.85.158.91, TLS, session=<ayfA1fVDteBBFJtd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.230.7
country_id: 798544
description:
Nov 19 22:53:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=193.43.230.7, lip=66.85.158.91, TLS, session=<OYOp1PVDyJjBK+YH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-19 22:57:59 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:44664: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-19 22:58:10 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:54666: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:58:52 host2 sshd[641359]: Disconnected from invalid user username 140.238.15.104 port 52906 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.55.41.75
country_id: 357994
description:
[2025-11-19 23:07:06 +0530] info [cpaneld] 197.55.41.75 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.139
country_id: 1269750
description:
Nov 19 23:07:09 host2 sshd[647292]: Disconnected from invalid user juan 205.254.166.139 port 46268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-11-19 23:13:47 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:50526: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-19 23:14:27 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:49002: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.139
country_id: 1269750
description:
Nov 19 23:18:08 host2 sshd[654001]: Disconnected from invalid user bender 205.254.166.139 port 1841 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 19 23:17:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, session=<Kjm0LfZDzj+4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov 19 23:18:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ymLOLvZDkJ9APpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov 19 23:18:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS: Connection closed, session=<ErjEMPZDEiVAPpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 19 23:20:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, session=<eXLUN/ZDvYGLYyMq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.45
country_id: 1880251
description:
Nov 19 23:21:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 22 secs): user=<>, rip=139.99.35.45, lip=66.85.158.91, session=<LwEvOfZDO4WLYyMt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.161.85
country_id: 3469034
description:
Nov 19 23:23:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.44.161.85, lip=66.85.158.91, TLS, session=<7gqmQfZDGpOxLKFV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.178
country_id: 3175395
description:
Nov 19 23:23:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.178, lip=66.85.158.91, TLS, session=<1UfOQvZD9MO5xQmy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.163
country_id: 2635167
description:
Nov 19 23:29:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r4+xVvZDvY2594mj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.78
country_id: 2635167
description:
Nov 19 23:29:14 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.78, lip=66.85.158.91, TLS, session=<Q/2fVvZDwbtX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.176
country_id: 2635167
description:
Nov 19 23:29:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nAGtWPZDf4VX7LCw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Nov 19 23:30:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pWaoWvZDY6a594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.180
country_id: 2635167
description:
Nov 19 23:31:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.180, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<eh2fXvZDBZRX7LC0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.163
country_id: 2635167
description:
Nov 19 23:30:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.163, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<4qujXPZDmexX7LCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.152
country_id: 2635167
description:
Nov 19 23:32:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<132YYPZDk9G594mY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 19 23:33:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0+2UZPZDw6K594mf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.173
country_id: 2635167
description:
Nov 19 23:32:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MoCZYvZDkeO594mt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.175
country_id: 2635167
description:
Nov 19 23:34:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.175, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<36SJaPZDOYC594mv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Nov 19 23:33:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<8DyOZvZDFapX7LCf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-11-19 23:35:38 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:51748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-19 23:35:57 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:37268: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.91.107.7
country_id: 6252001
description:
Nov 19 23:37:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.91.107.7, lip=66.85.158.91, session=<Q1XudfZD2JuKW2sH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.96.197
country_id: 6252001
description:
Nov 19 23:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.233.96.197, lip=66.85.158.92, session=<qCiye/ZDVKeH6WDF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-19 23:50:44 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:61782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-19 23:50:53 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58510: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:53:38 host2 sshd[677593]: Disconnected from invalid user postgres 98.159.109.235 port 34864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 19 23:54:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<Dx32sPZDUD+s7ORz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Nov 19 23:54:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.92, session=<p4H5sPZDOvotIVDz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:56:14 host2 sshd[679890]: Disconnected from invalid user admin 98.159.109.235 port 48864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-19 23:57:03 dovecot_login authenticator failed for ([128.185.224.109]) [125.20.253.86]:57156: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-19 23:56:48 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:38854: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:57:38 host2 sshd[680829]: Disconnected from invalid user prod 98.159.109.235 port 58256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.125.141.16
country_id: 2750405
description:
Nov 20 00:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=625) failed: Connection reset by peer (no auth attempts in 38 secs): user=<>, rip=52.125.141.16, lip=66.85.158.91, TLS: read(size=625) failed: Connection reset by peer, session=</km93fZDxA40fY0Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.92
country_id: 3469034
description:
Nov 20 00:07:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=200.196.143.92, lip=66.85.158.91, TLS, session=<98ZV3fZDc+TIxI9c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.125.141.22
country_id: 2750405
description:
Nov 20 00:07:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=625) failed: Connection reset by peer (no auth attempts in 42 secs): user=<>, rip=52.125.141.22, lip=66.85.158.91, TLS: read(size=625) failed: Connection reset by peer, session=</4nA3vZDzy00fY0W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.23.198
country_id: 798544
description:
Nov 20 00:07:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=80.82.23.198, lip=66.85.158.91, TLS, session=<kEmX3vZDlqhQUhfG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.210
country_id: 6252001
description:
Nov 20 00:11:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rxr47PZDacOTuYTS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-20 00:18:58 dovecot_plain authenticator failed for (folum) [76.190.155.43]:41064: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:20:41 host2 sshd[697687]: Disconnected from invalid user user 103.226.139.104 port 57156 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@seyawin.com [11/19/2025:18:51:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@seyawin.com


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.25.42
country_id: 6252001
description:
Nov 20 00:21:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.25.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RWYSEfdDxsYUqxkq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:23:15 host2 sshd[699057]: Disconnected from invalid user omer 103.226.139.104 port 40790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 20 00:24:06 host2 pure-ftpd[699548]: (?@147.185.132.234) [INFO] New connection from 147.185.132.234


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:24:40 host2 sshd[699864]: Disconnected from invalid user oracle 103.226.139.104 port 36110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:30:10 host2 sshd[703027]: Disconnected from invalid user devops 103.226.139.104 port 49710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 20 00:32:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<yUp+OfdDzg6nXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-20 00:40:47 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:37336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 00:41:53 host2 sshd[709062]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-20 00:41:08 dovecot_login authenticator failed for ([201.172.88.85]) [201.172.88.85]:60801: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 00:42:15 host2 sshd[709280]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.50.254.252
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.50.254.252 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 00:46:57 host2 sshd[712401]: Disconnected from invalid user user 2.57.121.25 port 34165 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.195
country_id: 6252001
description:
Nov 20 00:47:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sAF4bfdD4sQUQGjD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.214.9
country_id: 933860
description:
Nov 20 00:49:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=41.216.214.9, lip=66.85.158.91, TLS, session=<qspYc/dD1p4p2NYJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.247
country_id: 3469034
description:
Nov 20 00:49:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.128.247, lip=66.85.158.91, TLS, session=<6tymdPdDMpm/NYD3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.143
country_id: 3469034
description:
Nov 20 00:49:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=177.44.71.143, lip=66.85.158.91, TLS, session=<d2+WdPdDA9KxLEeP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.18
country_id: 798544
description:
Nov 20 00:49:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.219.102.18, lip=66.85.158.91, TLS, session=<p5thc/dDP92y22YS>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@seyawin.com [11/19/2025:19:25:41 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@seyawin.com


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Nov 20 01:03:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.207.181, lip=66.85.158.91, session=<DmD/pfdDJOItT8+1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.81.178.241
country_id: 3057568
description:
Nov 20 01:15:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=213.81.178.241, lip=66.85.158.91, TLS, session=<cJho0PdDMw3VUbLx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.255
country_id: 3057568
description:
Nov 20 01:15:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.226.113.255, lip=66.85.158.91, TLS, session=<OjeH0fdDHatb4nH/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-20 01:19:59 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:47086: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-20 01:20:14 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:44828: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-20 01:38:17 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:55737: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-20 01:38:30 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:47658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-20 01:39:43 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (pught) [98.40.101.10]:52222: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-20 01:48:44 dovecot_plain authenticator failed for (taner) [76.190.155.43]:43600: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.22
country_id: 3469034
description:
Nov 20 01:52:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.240.37.22, lip=66.85.158.91, TLS, session=<sPXTVvhDf8K/8CUW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.37
country_id: 953987
description:
Nov 20 01:53:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=102.64.37.37, lip=66.85.158.91, TLS, session=<iPAPWPhD5LlmQCUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:54:06 host2 sshd[761552]: Disconnected from invalid user esbuser 196.189.116.182 port 58466 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 01:55:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.212, lip=66.85.158.91, session=<hV7gYPhDMsiUcdbU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:58:08 host2 sshd[764635]: Disconnected from invalid user hacker 196.189.116.182 port 55552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:59:32 host2 sshd[765421]: Disconnected from invalid user runner 196.189.116.182 port 37536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 20 02:02:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HxdbefhD8vRChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.85.20
country_id: 3865483
description:
Nov 20 02:04:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.181.85.20, lip=66.85.158.91, TLS, session=<DE7hf/hDHra+tVUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.193
country_id: 690791
description:
Nov 20 02:04:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=176.103.25.193, lip=66.85.158.91, TLS, session=<bAcmgfhDEc2wZxnB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.36.38
country_id: 99237
description:
[2025-11-20 02:08:41 +0530] info [whostmgrd] 169.224.36.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:16:39 host2 sshd[776444]: Disconnected from invalid user ubuntu 187.110.238.50 port 50852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:17:54 host2 sshd[777150]: Disconnected from invalid user masud 45.78.227.155 port 57564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:17:18 host2 sshd[776791]: Disconnected from invalid user student10 107.150.106.178 port 57502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:19:06 host2 sshd[777802]: Disconnected from invalid user danil 107.150.106.178 port 53136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:20:52 host2 sshd[778955]: Disconnected from invalid user pivpn 51.83.129.117 port 46694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:21:32 host2 sshd[779313]: Disconnected from invalid user rich 198.46.207.98 port 46670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:21:40 host2 sshd[779356]: Disconnected from invalid user syncthing 187.110.238.50 port 50080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:22:23 host2 sshd[779698]: Disconnected from invalid user ica 41.33.91.226 port 58744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:23:05 host2 sshd[780043]: Disconnected from invalid user last 51.83.129.117 port 47864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:23:11 host2 sshd[780079]: Disconnected from invalid user newftpuser 187.110.238.50 port 52684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:23:43 host2 sshd[780349]: Disconnected from invalid user mostafa 41.33.91.226 port 39806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:24:44 host2 sshd[781089]: Disconnected from invalid user kate 187.110.238.50 port 55286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:24:14 host2 sshd[780810]: Disconnected from invalid user wanghao 51.83.129.117 port 48440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:24:21 host2 sshd[780883]: Disconnected from invalid user qendrimellupo 103.117.56.152 port 41176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:25:20 host2 sshd[781527]: Disconnected from invalid user git 51.83.129.117 port 49014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:26:22 host2 sshd[782208]: Disconnected from invalid user sachi 187.110.238.50 port 57890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:27:41 host2 sshd[782828]: Disconnected from invalid user devops 103.193.178.248 port 38540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:27:09 host2 sshd[782573]: Disconnected from invalid user mostafa 198.46.207.98 port 34614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:27:21 host2 sshd[782662]: Disconnected from invalid user mark 41.33.91.226 port 45520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:28:14 host2 sshd[783140]: Disconnected from invalid user testuser 198.46.207.98 port 41928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:29:13 host2 sshd[783688]: Disconnected from invalid user helpdesk 103.193.178.248 port 56354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:30:55 host2 sshd[784772]: Disconnected from invalid user temp 103.117.56.152 port 57792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:33:06 host2 sshd[785919]: Disconnected from invalid user roman 103.193.178.248 port 53668 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 02:36:22 host2 sshd[788023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:39:44 host2 sshd[789433]: Disconnected from invalid user sachi 45.78.227.155 port 44094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 02:41:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63641: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-20 02:41:51 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:51612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-20 02:41:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50426: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 02:41:40 host2 sshd[791673]: Disconnected from invalid user ali 62.60.131.157 port 60033 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:40 host2 pure-ftpd[792337]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:47 host2 pure-ftpd[792405]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.65
country_id: 2510769
description:
Nov 20 02:43:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=139.28.190.65, lip=66.85.158.91, TLS, session=<62tYDflDbuCLHL5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.124
country_id: 298795
description:
Nov 20 02:44:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=45.67.155.124, lip=66.85.158.91, TLS, session=<mg54DvlD3LAtQ5t8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:44:09 host2 sshd[793054]: Disconnected from invalid user ben 62.219.172.50 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:46:27 host2 sshd[794668]: Disconnected from invalid user gpu 62.219.172.50 port 35590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:47:26 host2 sshd[795534]: Disconnected from invalid user system 103.117.56.152 port 33924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:47:34 host2 sshd[795642]: Disconnected from invalid user victor 62.219.172.50 port 51794 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.164.177.29
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.164.177.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.146.155.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.146.155.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.56.153.139
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 93.56.153.139 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.164.100.80
country_id: 2658434
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 31.164.100.80 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-20 02:49:12 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51746: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.49.162
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.49.162 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.91.124.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.91.124.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-11-20 02:49:48 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:51670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:50:30 host2 sshd[797399]: Disconnected from invalid user fad 103.117.56.152 port 35454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:50:33 host2 sshd[797441]: Disconnected from invalid user ir 179.32.207.251 port 48730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:51:50 host2 sshd[798217]: Disconnected from invalid user frappe 179.32.207.251 port 51984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:52:11 host2 sshd[798380]: Disconnected from invalid user steamcmd 62.219.172.50 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:53:08 host2 sshd[799011]: Disconnected from invalid user steamcmd 179.32.207.251 port 55216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:54:15 host2 sshd[799348]: Disconnected from invalid user ubuntu 45.78.227.155 port 37074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.233.185.13
country_id: 798544
description:
Nov 20 03:00:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.233.185.13, lip=66.85.158.91, TLS, session=<NxhVSPlDtspb6bkN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.111
country_id: 3469034
description:
Nov 20 03:00:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.243.111, lip=66.85.158.91, TLS, session=<72Z2SflD8Ny60fNv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 03:05:07 host2 sshd[807159]: Disconnected from invalid user user 2.57.121.25 port 51592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 20 03:06:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<yHY5X/lDkKCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:11:35 host2 sshd[810909]: Disconnected from invalid user himanshu 206.217.136.36 port 57842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Nov 20 03:11:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.91, session=<C0w4cvlDmPjN0h/J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:11:44 host2 sshd[810970]: Disconnected from invalid user pivpn 41.82.208.178 port 28263 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:11:46 host2 sshd[810985]: Disconnected from invalid user ahmed 45.79.189.171 port 59158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:12:54 host2 sshd[811567]: Disconnected from invalid user nodeuser 45.79.189.171 port 53558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.201
country_id: 3175395
description:
Nov 20 03:14:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=171.22.235.201, lip=66.85.158.91, TLS, session=<dwfPeflDesqrFuvJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.86.60
country_id: 3469034
description:
Nov 20 03:14:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=131.196.86.60, lip=66.85.158.91, TLS, session=<ncz1evlD9oiDxFY8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:15:07 host2 sshd[812771]: Disconnected from invalid user trading 45.79.189.171 port 39990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:15:19 host2 sshd[812921]: Disconnected from invalid user yyy 41.82.208.178 port 1565 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:17:03 host2 sshd[813744]: Disconnected from invalid user andrey 206.217.136.36 port 48258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:17:14 host2 sshd[813813]: Disconnected from invalid user ubuntu 45.79.189.171 port 53472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:17:38 host2 sshd[813975]: Disconnected from invalid user admin 161.10.72.136 port 47672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:23:31 host2 sshd[816560]: Disconnected from invalid user ubuntu 161.10.72.136 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:24:57 host2 sshd[817215]: Disconnected from invalid user git 161.10.72.136 port 59834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-20 03:25:29 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:60435: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.116
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819321]: (?@195.184.76.116) [INFO] New connection from 195.184.76.116


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.118
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819323]: (?@195.184.76.118) [INFO] New connection from 195.184.76.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-20 03:46:54 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:60530: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-20 03:47:11 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:38956: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.99.35
country_id: 1269750
description:
Nov 20 03:50:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.107.99.35, lip=66.85.158.91, TLS, session=<znBS+vlDj95na2Mj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.4
country_id: 1269750
description:
Nov 20 03:50:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.51.223.4, lip=66.85.158.91, TLS, session=<rYik+/lDEp1nM98E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.97.152
country_id: 3469034
description:
Nov 20 03:51:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.97.152, lip=66.85.158.91, TLS, session=<sXQkAPpDpoixLGGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.194
country_id: 1269750
description:
Nov 20 03:52:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.51.223.194, lip=66.85.158.91, TLS, session=<yu5cAfpDfe1nM9/C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:56:14 host2 sshd[837431]: Disconnected from invalid user admin 152.32.191.75 port 54468 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:43 host2 pure-ftpd[837933]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:34 host2 pure-ftpd[837805]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:57:29 host2 sshd[838895]: Disconnected from invalid user developer 152.32.191.75 port 38708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:58:47 host2 sshd[840202]: Disconnected from invalid user marian 152.32.191.75 port 46460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 03:59:21 host2 sshd[840594]: Disconnected from invalid user sammy 198.98.57.141 port 44986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:59:59 host2 sshd[840997]: Disconnected from invalid user support 152.32.191.75 port 47736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:00:33 host2 sshd[841684]: Disconnected from invalid user marian 198.98.57.141 port 44120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.178.110.228
country_id: 732800
description:
[2025-11-20 04:02:09 +0530] info [cpaneld] 195.178.110.228 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:01:40 host2 sshd[842396]: Disconnected from invalid user admin 198.98.57.141 port 43256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:02:53 host2 sshd[843263]: Disconnected from invalid user mustafa 119.92.70.82 port 38358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.6.218.173
country_id: 3595528
description:
2025-11-20 04:05:43 dovecot_login authenticator failed for 173.218.6.200.static.intelnet.net.gt [200.6.218.173]:38045: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.131.165.45
country_id: 2661886
description:
2025-11-20 04:05:55 dovecot_login authenticator failed for ([88.131.165.45]) [88.131.165.45]:57084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov 20 04:05:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.91, session=<fvE7NPpD+oCUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:07:04 host2 sshd[848402]: Disconnected from invalid user dima 158.69.194.34 port 55670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:06:41 host2 sshd[847859]: Disconnected from invalid user admin 119.92.70.82 port 38436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:06:54 host2 sshd[848146]: Disconnected from invalid user support 134.209.225.104 port 59448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:06:57 host2 sshd[848211]: Disconnected from invalid user mustafa 203.161.184.246 port 15707 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:08:08 host2 sshd[849547]: Disconnected from invalid user support 158.69.194.34 port 50402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:08:15 host2 sshd[849697]: Disconnected from invalid user smith 101.36.108.134 port 56532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:07:19 host2 sshd[848618]: Disconnected from invalid user mt 103.244.91.128 port 52790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:07:48 host2 sshd[849114]: Disconnected from invalid user dima 139.59.66.39 port 45628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:08:57 host2 sshd[850627]: Disconnected from invalid user grace 77.192.248.233 port 59995 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:09:07 host2 sshd[850859]: Disconnected from invalid user stack 139.59.66.39 port 34708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:10:11 host2 sshd[852244]: Disconnected from invalid user guest 101.36.108.134 port 50716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:10:13 host2 sshd[852291]: Disconnected from invalid user scanner 134.209.225.104 port 43974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:11:03 host2 sshd[853616]: Disconnected from invalid user tobias 119.92.70.82 port 46150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:10:24 host2 sshd[852569]: Disconnected from invalid user sysadmin 139.59.66.39 port 54750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:12:27 host2 sshd[855144]: Disconnected from invalid user reboot 158.69.194.34 port 44458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:13:07 host2 sshd[855690]: Disconnected from invalid user admin 205.185.125.150 port 51190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:12:40 host2 sshd[855242]: Disconnected from invalid user runner 119.92.70.82 port 48716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:12:54 host2 sshd[855401]: Disconnected from invalid user ubuntu 103.244.91.128 port 41816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:13:04 host2 sshd[855614]: Disconnected from invalid user tomcat 103.76.120.35 port 50536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:14:11 host2 sshd[856799]: Disconnected from invalid user tao 103.244.91.128 port 37466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:14:38 host2 sshd[857129]: Disconnected from invalid user smith 77.192.248.233 port 11787 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:14:28 host2 sshd[857018]: Disconnected from invalid user www 103.76.120.35 port 40668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:16:09 host2 sshd[858827]: Disconnected from invalid user tobias 203.161.184.246 port 44726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:15:40 host2 sshd[858340]: Disconnected from invalid user user01 101.36.108.134 port 47448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:15:49 host2 sshd[858476]: Disconnected from invalid user newuser 119.92.70.82 port 53882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:16:21 host2 sshd[859087]: Disconnected from invalid user myftp 134.209.225.104 port 41796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:16:59 host2 sshd[859682]: Disconnected from invalid user t 104.168.4.151 port 38552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:17:10 host2 sshd[859920]: Disconnected from invalid user tao 101.36.108.134 port 51376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:17:15 host2 sshd[860133]: Disconnected from invalid user qihang 103.76.120.35 port 45444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:16:43 host2 sshd[859406]: Disconnected from invalid user eacadm 205.185.125.150 port 50000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:18:00 host2 sshd[860795]: Disconnected from invalid user user01 77.192.248.233 port 53692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:18:35 host2 sshd[861315]: Disconnected from invalid user axel 205.185.125.150 port 49406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:20:14 host2 sshd[863166]: Disconnected from invalid user raccmcserver 104.168.4.151 port 38898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.34
country_id: 2510769
description:
Nov 20 04:19:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=139.28.190.34, lip=66.85.158.91, TLS, session=<4yHrY/pDnryLHL4i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.135
country_id: 3469034
description:
Nov 20 04:19:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.96.135, lip=66.85.158.91, TLS, session=<dWYCZfpDt8+/8GCH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:21:16 host2 sshd[864335]: Disconnected from invalid user magento 104.168.4.151 port 39010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:22:24 host2 sshd[865436]: Disconnected from invalid user aaa 205.185.125.150 port 48218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:23:41 host2 sshd[868321]: Disconnected from invalid user magento 103.76.120.35 port 43806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-11-20 04:28:42 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:57074: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Nov 20 04:28:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.148, lip=66.85.158.92, TLS: Connection closed, session=<iOSxhfpDDpjHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-20 04:29:27 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1219: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-20 04:29:46 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:36085: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.252.27.223
country_id: 6252001
description:
Nov 20 04:29:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.252.27.223, lip=66.85.158.92, TLS: Connection closed, session=<uBq3ifpDWIMs/Bvf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-20 04:30:04 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:38041: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 04:30:50 host2 sshd[873118]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 04:32:17 host2 sshd[873913]: Disconnected from invalid user user 2.57.121.25 port 29236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-20 04:34:32 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:40204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.198
country_id: 6252001
description:
Nov 20 04:35:08 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.198, lip=66.85.158.92, session=<XmGWnPpD5h6s7OTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.185.98.251
country_id: 6252001
description:
2025-11-20 04:35:11 dovecot_login authenticator failed for (47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net) [47.185.98.251]:20076: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.216
country_id: 2395170
description:
Nov 20 04:36:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=154.127.36.216, lip=66.85.158.91, TLS, session=<fd55ofpDWOyafyTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.20
country_id: 99237
description:
Nov 20 04:37:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=65.20.136.20, lip=66.85.158.91, TLS, session=<5xGaovpDkrRBFIgU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:47:04 host2 sshd[882898]: Disconnected from invalid user ian 185.202.207.17 port 55310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov 20 04:47:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, session=<FJvpyfpDNJmsaAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Nov 20 04:50:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lAf/0/pDpd7G6xik>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:51:13 host2 sshd[885219]: Disconnected from invalid user joel 66.96.239.187 port 46802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 04:51:38 host2 sshd[885492]: Disconnected from invalid user chen 103.123.227.244 port 38286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:52:31 host2 sshd[885933]: Disconnected from invalid user huake 66.96.239.187 port 33936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 20 04:54:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, session=<htm34PpDaMCUcdZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:55:04 host2 sshd[887895]: Disconnected from invalid user user 66.96.239.187 port 39148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:55:46 host2 sshd[888604]: Disconnected from invalid user huake 185.202.207.17 port 40306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:56:12 host2 sshd[888966]: Disconnected from invalid user gp 219.89.194.78 port 36890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:56:24 host2 sshd[889064]: Disconnected from invalid user deployer 66.96.239.187 port 33190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:57:50 host2 sshd[889810]: Disconnected from invalid user mm 219.89.194.78 port 44236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-20 04:58:55 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (auganhomia) [74.218.95.154]:50576: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.87.153
country_id: 6252001
description:
Nov 20 04:59:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.144.87.153, lip=66.85.158.91, TLS: Connection closed, session=<giYB8vpD9LoSkFeZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:01:17 host2 sshd[892082]: Disconnected from invalid user ob 103.123.227.244 port 53858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:02:57 host2 sshd[892934]: Disconnected from invalid user admin 219.89.194.78 port 60472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Nov 20 05:04:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sI0CBftDL83N0h9W>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 05:06:12 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (paderimete) [81.225.30.107]:52337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:08:05 host2 sshd[896518]: Disconnected from invalid user iptv 103.123.227.244 port 37300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:08:22 host2 sshd[896660]: Disconnected from invalid user deployer 219.89.194.78 port 49330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:11:24 host2 sshd[898814]: Disconnected from invalid user eric 118.193.61.63 port 13634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:11:28 host2 sshd[898830]: Disconnected from invalid user maria 103.123.227.244 port 43904 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.100
country_id: 3017382
description:
Nov 20 05:11:32 host2 pure-ftpd[898882]: (?@91.196.152.100) [INFO] New connection from 91.196.152.100


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.102
country_id: 3017382
description:
Nov 20 05:11:34 host2 pure-ftpd[898895]: (?@91.196.152.102) [INFO] New connection from 91.196.152.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.34.116
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.254.34.116 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:14:03 host2 sshd[900380]: Disconnected from invalid user info 118.193.61.63 port 13674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.85
country_id: 3865483
description:
Nov 20 05:15:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.195.85, lip=66.85.158.91, TLS, session=<S/egLPtDAc614cNV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.134
country_id: 933860
description:
Nov 20 05:16:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.134, lip=66.85.158.91, TLS, session=<qzrmLftD0Icp2NWG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:19:24 host2 sshd[903758]: Disconnected from invalid user ir 58.98.200.129 port 53014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:23:16 host2 sshd[906027]: Disconnected from invalid user st 103.153.110.189 port 36202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:25:03 host2 sshd[907499]: Disconnected from invalid user dtl 58.98.200.129 port 48606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:26:05 host2 sshd[908385]: Disconnected from invalid user yang 103.153.110.189 port 37724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:25:42 host2 sshd[908152]: Disconnected from invalid user ehsan 103.25.47.94 port 39872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:26:38 host2 sshd[908688]: Disconnected from invalid user ruben 162.214.126.1 port 59724 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Nov 20 05:27:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qnG0V/tDtMuTuYQ/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:27:33 host2 sshd[909216]: Disconnected from invalid user odoo 103.153.110.189 port 57788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 05:27:42 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:60571: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:27:59 host2 sshd[909457]: Disconnected from invalid user halley 103.25.47.94 port 45168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:30:16 host2 sshd[911160]: Disconnected from invalid user ehsan 162.214.126.1 port 58970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:30:34 host2 sshd[911313]: Disconnected from invalid user stepan 103.153.110.189 port 40552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:30:43 host2 sshd[911424]: Disconnected from invalid user gpu 58.98.200.129 port 53483 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-20 05:31:48 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:50704: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-20 05:31:20 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:47088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:31:20 host2 sshd[911811]: Disconnected from invalid user ava 162.214.126.1 port 58732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:32:26 host2 sshd[912492]: Disconnected from invalid user sysop 162.214.126.1 port 58474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:32:45 host2 sshd[912701]: Disconnected from invalid user gast 103.25.47.94 port 47068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:33:43 host2 sshd[913146]: Disconnected from invalid user valheim 103.153.110.189 port 57264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 05:33:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pards) [87.103.126.54]:42292: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:33:34 host2 sshd[913097]: Disconnected from invalid user csadmin 162.214.126.1 port 58228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.77
country_id: 2186224
description:
2025-11-20 05:34:50 dovecot_login authenticator failed for ([121.73.169.77]) [121.73.169.77]:45108: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-20 05:34:34 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:40236: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:35:58 host2 sshd[915270]: Disconnected from invalid user aso 103.25.47.94 port 48326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:37:30 host2 sshd[916185]: Disconnected from invalid user tester 103.25.47.94 port 48946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.53.194.185
country_id: 2661886
description:
2025-11-20 05:38:48 dovecot_plain authenticator failed for ec2-13-53-194-185.eu-north-1.compute.amazonaws.com (EC2AMAZ-9MJPURA.eu-north-1.compute.internal) [13.53.194.185]:60486: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.28.201
country_id: 3469034
description:
Nov 20 05:39:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.152.28.201, lip=66.85.158.91, TLS, session=<kBDMgPtDR8yxmBzJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.108
country_id: 1269750
description:
Nov 20 05:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.237.58.108, lip=66.85.158.91, TLS, session=<AGcEgvtDIOdn7Tps>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 20 05:41:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QHaHiPtDWENChJl6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 20 05:43:58 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.91, TLS, session=<YnPHkvtDNI1HBobo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.40.205
country_id: 1819730
description:
Nov 20 05:49:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.40.205, lip=66.85.158.91, session=<3rXVpPtDmt+lmijN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.40.205
country_id: 1819730
description:
Nov 20 05:49:02 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.40.205, lip=66.85.158.91, TLS, session=<kIHjpPtDquClmijN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 20 05:49:07 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS, session=<VZMypftDB4C594lI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 05:49:53 host2 sshd[925048]: Disconnected from invalid user martina 62.60.131.157 port 61384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 05:54:15 host2 sshd[928268]: Disconnected from invalid user user 2.57.121.25 port 53594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 20 06:03:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS: Connection closed, session=<xiR11/tDlOxChJlw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.43.53
country_id: 2921044
description:
Nov 20 06:17:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.211.43.53, lip=66.85.158.91, session=<DuxWCfxDyJII0ys1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 136.169.114.247
country_id: 458258
description:
Nov 20 06:18:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=136.169.114.247, lip=66.85.158.91, TLS, session=<pNIwDfxDu7KIqXL3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.2
country_id: 3469034
description:
Nov 20 06:18:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.137.2, lip=66.85.158.91, TLS, session=<VThYDvxDU+2+WYkC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-20 06:19:53 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:58622: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 06:19:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61242: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-20 06:19:38 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:34252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.31
country_id: 6252001
description:
Nov 20 06:22:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.31, lip=66.85.158.92, TLS, session=<+LNdHfxDpPuTuYQf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 06:25:10 host2 sshd[950982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.179
country_id: 6252001
description:
Nov 20 06:25:33 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.182.179, lip=66.85.158.92, session=<+zh+J/xDns6lmraz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 20 06:25:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<gf0IJ/xDyr5HBpK6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.179
country_id: 6252001
description:
Nov 20 06:26:44 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.182.179, lip=66.85.158.91, session=<8lC0K/xD0r6lmraz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.51.234.233
country_id: 6252001
description:
Nov 20 06:27:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.51.234.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MB9WLfxDiNIUM+rp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.102.16.171
country_id: 3469034
description:
Nov 20 06:43:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.102.16.171, lip=66.85.158.91, TLS, session=<MW8KZ/xDBre7ZhCr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.233.77
country_id: 1694008
description:
Nov 20 06:43:44 host2 sshd[962229]: Connection reset by invalid user test 165.154.233.77 port 39598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.196
country_id: 3865483
description:
Nov 20 06:44:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=186.190.167.196, lip=66.85.158.91, TLS, session=<k7qFaPxDl7G6vqfE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 06:47:58 host2 sshd[965388]: Disconnected from invalid user martina 62.60.131.157 port 11912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.130.197.3
country_id: 798544
description:
Nov 20 06:52:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=195.130.197.3, lip=66.85.158.91, TLS, session=<Hnk/h/xD1r3DgsUD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.196
country_id: 3996063
description:
Nov 20 06:52:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=138.122.97.196, lip=66.85.158.91, TLS, session=<lVRTiPxDzYKKemHE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 06:54:51 host2 sshd[970521]: Disconnected from invalid user user 2.57.121.25 port 21351 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 07:07:11 host2 sshd[978811]: Disconnected from invalid user maryam 62.60.131.157 port 24146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.75
country_id: 3865483
description:
Nov 20 07:13:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=200.229.252.75, lip=66.85.158.91, TLS, session=<hnNo0/xDdbLI5fxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.86.63
country_id: 732800
description:
Nov 20 07:14:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.107.86.63, lip=66.85.158.91, TLS, session=<1saj1PxDeNJta1Y/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.40
country_id: 3469034
description:
Nov 20 07:15:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.224.97.40, lip=66.85.158.91, TLS, session=<o3062fxDbei64GEo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.179
country_id: 3865483
description:
Nov 20 07:15:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=190.122.128.179, lip=66.85.158.91, TLS, session=<SoGA2vxD/8q+eoCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-20 07:16:39 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:54806: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-20 07:16:48 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:65191: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:24:09 host2 sshd[988402]: Disconnected from invalid user admin 107.174.82.236 port 48262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-20 07:25:18 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (spurocces) [73.195.211.98]:55964: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:25:08 host2 sshd[989105]: Disconnected from invalid user sunil 107.174.82.236 port 40086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:26:10 host2 sshd[990101]: Disconnected from invalid user roo 107.174.82.236 port 35408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:28:07 host2 sshd[991575]: Disconnected from invalid user rdp 107.174.82.236 port 50348 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.234.28.194
country_id: 1643084
description:
[2025-11-20 07:30:48 +0530] info [whostmgrd] 103.234.28.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.76
country_id: 3469034
description:
Nov 20 07:43:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.216.88.76, lip=66.85.158.91, TLS, session=<OYcnPP1DmM662FhM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.56
country_id: 3469034
description:
Nov 20 07:43:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=186.209.249.56, lip=66.85.158.91, TLS, session=<DoWNPf1DkqW60fk4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 07:44:16 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:50654: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:50:38 host2 sshd[1005264]: Disconnected from invalid user front-user 177.85.247.230 port 31368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.137
country_id: 1880251
description:
Nov 20 07:51:10 host2 sshd[1005555]: Disconnected from invalid user azureuser 157.245.55.137 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:52:54 host2 sshd[1006566]: Disconnected from invalid user suporte 177.85.247.230 port 17110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-20 07:54:03 dovecot_plain authenticator failed for (minen) [91.73.195.150]:40636: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.55.137
country_id: 1880251
description:
Nov 20 07:54:30 host2 sshd[1007944]: Disconnected from invalid user front-user 157.245.55.137 port 58262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.227
country_id: 6252001
description:
Nov 20 07:55:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.227, lip=66.85.158.92, session=<9MqgaP1DOOHG6xjj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:57:14 host2 sshd[1010038]: Disconnected from invalid user dylan 177.85.247.230 port 53266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 08:01:21 host2 sshd[1013099]: Disconnected from invalid user app 177.85.247.230 port 40648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.97
country_id: 298795
description:
Nov 20 08:02:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=95.0.171.97, lip=66.85.158.91, TLS, session=<b5hngf1DyKBfAKth>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 20 08:02:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<ZHUVg/1D8oOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.248.74.236
country_id: 2363686
description:
Nov 20 08:02:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=80.248.74.236, lip=66.85.158.91, TLS, session=<E1OBgv1DK79Q+Ers>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:10:24 host2 sshd[1020312]: Disconnected from invalid user user1 186.96.151.198 port 36058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.156
country_id: 1880251
description:
Nov 20 08:15:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=15.235.189.156, lip=66.85.158.92, session=<Du7Rr/1Dg80P672c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:15:15 host2 sshd[1024478]: Disconnected from invalid user admin 186.96.151.198 port 43608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:19:31 host2 sshd[1027035]: Disconnected from invalid user admin 186.96.151.198 port 37226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:19:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1qHsv/1D09Mjy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:20:06 host2 sshd[1027609]: Disconnected from invalid user user1 91.240.15.18 port 36818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:20:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nXtMxP1DbOgjy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.114
country_id: 1643084
description:
Nov 20 08:21:24 host2 sshd[1028452]: Disconnected from invalid user netbox 203.145.34.114 port 49452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:21:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<YTvMxP1D8O4jy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 08:23:47 host2 sshd[1029828]: Disconnected from invalid user dimitri 62.60.131.157 port 58774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Nov 20 08:24:07 host2 sshd[1029936]: Disconnected from invalid user vbox 45.78.228.110 port 36254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:24:35 host2 sshd[1030347]: Disconnected from invalid user ubuntu 91.240.15.18 port 46194 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:27:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS, session=<P7iN3P1DFOgjy9IN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2025-11-20 08:31:24 dovecot_login authenticator failed for (Copy-of-VM-2022) [45.94.31.41]:41555: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 20 08:31:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yMM86v1DNtK58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-20 08:31:39 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:54622: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-20 08:31:56 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:55054: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:32:00 host2 sshd[1035321]: Disconnected from invalid user allan 91.240.15.18 port 51972 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.70.56
country_id: 2750405
description:
Nov 20 08:32:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.227.70.56, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FvPO6/1DEpNA40Y4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-20 08:31:23 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:40512: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 08:34:12 host2 sshd[1036688]: Disconnected from invalid user user 2.57.121.25 port 18658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-20 08:34:24 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:34507: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-20 08:34:41 dovecot_login authenticator failed for ([122.187.229.194]) [122.187.229.194]:40388: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.229
country_id: 6252001
description:
Nov 20 08:35:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<F0oN9/1Dks/N0h/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:36:57 host2 sshd[1038615]: Disconnected from invalid user bpuser 190.207.47.141 port 43544 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 20 08:37:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2rlB//1D4Lq58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.153.174.18
country_id: 298795
description:
Nov 20 08:39:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=213.153.174.18, lip=66.85.158.91, TLS, session=<EoTKBf5DrbTVma4S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.141
country_id: 3175395
description:
Nov 20 08:39:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=185.63.132.141, lip=66.85.158.91, TLS, session=<bkzfBv5D2Iy5P4SN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:41:03 host2 sshd[1041481]: Disconnected from invalid user support 190.207.47.141 port 59126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:42:19 host2 sshd[1042276]: Disconnected from invalid user admin 190.207.47.141 port 54830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:42:30 host2 sshd[1042386]: Disconnected from invalid user x 103.4.145.49 port 33636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:43:38 host2 sshd[1043054]: Disconnected from invalid user x 190.207.47.141 port 45164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:44:56 host2 sshd[1043998]: Disconnected from invalid user cs 190.207.47.141 port 59386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:45:30 host2 sshd[1045337]: Disconnected from invalid user bpuser 103.4.145.49 port 34766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:46:53 host2 sshd[1047356]: Disconnected from invalid user mahsa 103.4.145.49 port 35324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:55:20 host2 sshd[1053231]: Disconnected from invalid user simon 83.49.192.37 port 40406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:58:42 host2 sshd[1055544]: Disconnected from invalid user cuser 83.49.192.37 port 48978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 08:59:36 host2 sshd[1056002]: Disconnected from invalid user adminftp 139.59.64.179 port 47820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:59:52 host2 sshd[1056178]: Disconnected from invalid user user 83.49.192.37 port 45242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.203
country_id: 3469034
description:
Nov 20 09:01:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.96.203, lip=66.85.158.91, TLS, session=<JAB1Uv5DyeS/8GDL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.58
country_id: 3865483
description:
Nov 20 09:00:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.0.249.58, lip=66.85.158.91, TLS, session=<Vr8kUf5DScqzAPk6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:00:57 host2 sshd[1057043]: Disconnected from invalid user ubuntu 139.59.64.179 port 49844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 09:00:59 host2 sshd[1057062]: Disconnected from invalid user alex 83.49.192.37 port 41552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:03:32 host2 sshd[1058990]: Disconnected from invalid user mas 139.59.64.179 port 53884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.141
country_id: 6252001
description:
Nov 20 09:04:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SwmzXv5DAows3LmN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 20 09:04:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<0Y6YYP5D4jtChJmA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:06:07 host2 sshd[1060731]: Disconnected from invalid user icp 139.59.64.179 port 57926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Nov 20 09:10:15 host2 sshd[1063475]: Disconnected from invalid user user 45.78.228.110 port 42628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-11-20 09:13:07 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:59290: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-20 09:12:36 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:49488: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-20 09:16:34 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:42207: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-20 09:16:19 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:39510: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:18:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4ROjkf5DA9Gi2JYU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:19:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<TWIvlf5DlOCi2JYU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:21:46 host2 sshd[1071123]: Disconnected from invalid user julius 54.39.165.17 port 33452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:24:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS, session=<eze+p/5DDOmi2JYU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:24:45 host2 sshd[1073069]: Disconnected from invalid user felix 54.39.165.17 port 42506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:24:51 host2 sshd[1073122]: Disconnected from invalid user backupuser 37.187.244.59 port 47760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:25:54 host2 sshd[1073872]: Disconnected from invalid user opsadmin 54.39.165.17 port 53090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-20 09:26:07 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:35464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-20 09:26:41 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:29:29 host2 sshd[1076061]: Disconnected from invalid user user1 37.187.244.59 port 44830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:30:34 host2 sshd[1076883]: Disconnected from invalid user ftpuser 37.187.244.59 port 53196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.210
country_id: 2300660
description:
Nov 20 09:40:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=41.139.5.210, lip=66.85.158.91, TLS, session=<mvSs3f5Dxr0piwXS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.194
country_id: 953987
description:
Nov 20 09:40:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.194, lip=66.85.158.91, TLS, session=<ADcQ3/5D/rhmgTnC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:45:29 host2 sshd[1088145]: Disconnected from invalid user lab 195.250.72.168 port 53474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:47:50 host2 sshd[1090348]: Disconnected from invalid user rf 64.227.160.133 port 57416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:47:54 host2 sshd[1090406]: Disconnected from invalid user test11 69.51.217.189 port 34284 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.148.26.145
country_id: 2802361
description:
Nov 20 09:48:47 host2 pure-ftpd[1091120]: (?@146.148.26.145) [INFO] New connection from 146.148.26.145


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:49:13 host2 sshd[1091481]: Disconnected from invalid user ubuntu 64.227.160.133 port 46448 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 09:51:18 host2 sshd[1093141]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 09:51:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:51:17 host2 sshd[1093129]: Disconnected from invalid user vinicius 69.51.217.189 port 44664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.63
country_id: 719819
description:
Nov 20 09:52:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.48.181.63, lip=66.85.158.91, TLS, session=<JG5DC/9DBr6yMLU/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 09:52:55 host2 sshd[1094112]: Disconnected from invalid user user 2.57.121.25 port 31221 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.164
country_id: 3469034
description:
Nov 20 09:53:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.209.247.164, lip=66.85.158.91, TLS, session=<eVBfDP9DTu260fek>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:53:27 host2 sshd[1094520]: Disconnected from invalid user tom 69.51.217.189 port 52236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-20 09:53:36 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:57828: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-20 09:53:59 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:51190: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:54:14 host2 sshd[1095160]: Disconnected from invalid user git 195.250.72.168 port 46664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:54:35 host2 sshd[1095771]: Disconnected from invalid user odoo 69.51.217.189 port 60990 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.112.83
country_id: 3469034
description:
Nov 20 09:56:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.120.112.83, lip=66.85.158.91, TLS, session=<lZSJGP9D7NC7eHBT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:56:36 host2 sshd[1097381]: Disconnected from invalid user odoo 195.250.72.168 port 41576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Nov 20 09:56:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<tyTPGf9DJ68p2NeO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:57:49 host2 sshd[1098137]: Disconnected from invalid user ftpadmin 195.250.72.168 port 43640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:58:08 host2 sshd[1098355]: Disconnected from invalid user steamcmd 64.227.160.133 port 47442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:58:57 host2 sshd[1098883]: Disconnected from invalid user vinicius 195.250.72.168 port 33494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:19:24 host2 sshd[1114223]: Disconnected from invalid user backend 138.124.20.112 port 42900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:19:28 host2 sshd[1114261]: Disconnected from invalid user vncuser 202.60.231.203 port 35984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.248
country_id: 6252001
description:
Nov 20 10:21:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iCrmc/9DWdbN0h/4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-20 10:22:44 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1148: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-20 10:22:57 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:32782: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:23:15 host2 sshd[1117113]: Disconnected from invalid user daisy 138.124.20.112 port 53614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:23:47 host2 sshd[1117388]: Disconnected from invalid user admin 202.60.231.203 port 42016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:28:04 host2 sshd[1120220]: Disconnected from invalid user dev 202.60.231.203 port 48052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:29:00 host2 sshd[1120694]: Disconnected from invalid user alex 138.124.20.112 port 34044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:30:03 host2 sshd[1121412]: Disconnected from invalid user base 138.124.20.112 port 57166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:30:12 host2 sshd[1121591]: Disconnected from invalid user jenkins 64.226.100.148 port 59022 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.0.149
country_id: 2215636
description:
Nov 20 10:33:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=5.63.0.149, lip=66.85.158.91, TLS, session=<WE+inv9DnpwFPwCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.72
country_id: 2510769
description:
Nov 20 10:34:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.229.98.72, lip=66.85.158.91, TLS, session=<HrhIoP9DtbO55WJI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.59
country_id: 3469034
description:
Nov 20 10:35:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=187.120.104.59, lip=66.85.158.91, TLS, session=<Cj2Cpf9DCN+7eGg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.85
country_id: 732800
description:
Nov 20 10:35:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.253.159.85, lip=66.85.158.91, TLS, session=<VzxmpP9Da+y5/Z9V>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:35:42 host2 sshd[1125181]: Disconnected from invalid user backend 64.226.100.148 port 47040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.217
country_id: 6252001
description:
Nov 20 10:40:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.217, lip=66.85.158.92, TLS, session=<m9+yuP9Dmv3N0h/Z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:41:08 host2 sshd[1128799]: Disconnected from invalid user sftp_user 64.226.100.148 port 41736 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 20 10:42:10 host2 sshd[1129339]: Disconnecting authenticating user root 173.24.18.140 port 37678: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 20 10:42:10 host2 sshd[1129339]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 37678 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:50:07 host2 sshd[1134724]: Disconnected from invalid user vivek 20.203.42.204 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:50:10 host2 sshd[1134817]: Disconnected from invalid user github 64.226.100.148 port 45094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 10:50:34 host2 sshd[1135145]: Disconnected from invalid user admin 152.200.205.179 port 55896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:51:59 host2 sshd[1135872]: Disconnected from invalid user admin 54.38.79.136 port 60026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:53:18 host2 sshd[1136610]: Disconnected from invalid user vivek 83.215.13.5 port 60424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:53:20 host2 sshd[1136675]: Disconnected from invalid user oliver 103.245.231.184 port 44930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 10:53:45 host2 sshd[1136846]: Disconnected from invalid user zakary 62.60.131.157 port 8798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:53:10 host2 sshd[1136526]: Disconnected from invalid user rbs 54.38.79.136 port 60640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:54:34 host2 sshd[1137767]: Disconnected from invalid user a 83.215.13.5 port 52926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:54:25 host2 sshd[1137698]: Disconnected from invalid user fmanager 103.245.231.184 port 37360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 10:55:28 host2 sshd[1138570]: Disconnected from invalid user oliver 152.200.205.179 port 48796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:55:47 host2 sshd[1138828]: Disconnected from invalid user bryan 83.215.13.5 port 38866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:55:27 host2 sshd[1138563]: Disconnected from invalid user bryan 103.245.231.184 port 45420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:56:30 host2 sshd[1139352]: Disconnected from invalid user admin 103.245.231.184 port 33230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:56:58 host2 sshd[1139642]: Disconnected from invalid user oliver 83.215.13.5 port 42568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:56:22 host2 sshd[1139239]: Disconnected from invalid user vivek 54.38.79.136 port 46336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:57:58 host2 sshd[1140249]: Disconnected from invalid user fmanager 20.203.42.204 port 44404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:59:39 host2 sshd[1141074]: Disconnected from invalid user adminer 20.203.42.204 port 38328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.70.183
country_id: 6252001
description:
Nov 20 11:00:05 host2 sshd[1141466]: Disconnected from invalid user polls 74.48.70.183 port 57650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:01:03 host2 sshd[1142144]: Disconnecting invalid user admin 5.187.97.40 port 43239: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 11:00:44 host2 sshd[1141941]: Disconnected from invalid user staging 83.215.13.5 port 58006 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:00:57 host2 sshd[1142048]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 42629 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:00:57 host2 sshd[1142048]: Disconnecting authenticating user root 5.187.97.40 port 42629: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.138
country_id: 3175395
description:
Nov 20 11:02:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.139.180.138, lip=66.85.158.91, TLS, session=<O8JLBgBELoi5i7SK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.132
country_id: 1269750
description:
Nov 20 11:03:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=103.8.118.132, lip=66.85.158.91, TLS, session=<cRl3BwBEBLZnCHaE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 11:03:15 host2 sshd[1143922]: Disconnected from invalid user a 152.200.205.179 port 59420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 11:04:34 host2 sshd[1144650]: Disconnected from invalid user bryan 152.200.205.179 port 39050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.70.183
country_id: 6252001
description:
Nov 20 11:06:12 host2 sshd[1145757]: Disconnected from invalid user adminer 74.48.70.183 port 60216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.27
country_id: 2510769
description:
Nov 20 11:10:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.214.138.27, lip=66.85.158.91, TLS, session=<8eiXIQBEc6+51oob>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.176
country_id: 3077311
description:
Nov 20 11:10:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=85.163.38.176, lip=66.85.158.91, TLS, session=<tFivIgBEKKpVoyaw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 20 11:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<QQVEKABEmLKLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.83.104.113
country_id: 1814991
description:
2025-11-20 11:13:18 dovecot_login authenticator failed for (ntY38njAkz) [49.83.104.113]:51055: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.83.104.113
country_id: 1814991
description:
2025-11-20 11:14:10 dovecot_login authenticator failed for (kaPwn3DR5) [49.83.104.113]:51554: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-20 11:15:26 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:39584: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-20 11:15:57 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:56328: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.141.90
country_id: 690791
description:
Nov 20 11:25:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=37.221.141.90, lip=66.85.158.91, TLS, session=<IGIyVwBEAZAl3Y1a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.189
country_id: 3469034
description:
Nov 20 11:25:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.189, lip=66.85.158.91, TLS, session=<VNVXWABEBqixLGC9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.115
country_id: 6252001
description:
Nov 20 11:28:43 host2 pure-ftpd[1160552]: (?@199.45.154.115) [INFO] New connection from 199.45.154.115


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:30:50 host2 sshd[1161912]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:40:05 host2 sshd[1168202]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:39:16 host2 sshd[1167494]: Disconnected from invalid user one 43.163.123.45 port 46622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:42:18 host2 sshd[1170227]: Disconnected from invalid user ubuntu 43.163.123.45 port 52796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:44:06 host2 sshd[1171657]: Disconnected from invalid user git 194.107.115.199 port 19747 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:43:58 host2 sshd[1171518]: Disconnected from invalid user paul 34.22.66.183 port 44632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-20 11:44:00 dovecot_plain authenticator failed for (plousionci) [24.93.140.162]:43403: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:45:36 host2 sshd[1173431]: Disconnected from invalid user gilbert 194.107.115.199 port 34956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:45:49 host2 sshd[1173697]: Disconnected from invalid user bogdan 116.193.191.159 port 37834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:47:03 host2 sshd[1174542]: Disconnected from invalid user hlw 194.107.115.199 port 50161 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:47:43 host2 sshd[1174994]: Disconnected from invalid user henry 34.22.66.183 port 60196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:48:08 host2 sshd[1175343]: Disconnected from invalid user happy 192.210.233.234 port 55310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 11:48:13 host2 sshd[1175411]: Disconnected from invalid user cisco 170.238.160.191 port 40470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:48:57 host2 sshd[1175875]: Disconnected from invalid user usuario2 34.22.66.183 port 54580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:49:47 host2 sshd[1176532]: Disconnected from invalid user upload 116.193.191.159 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 11:49:13 host2 sshd[1176106]: Disconnected from invalid user zakary 62.60.131.157 port 10020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 11:50:56 host2 sshd[1177562]: Disconnected from invalid user yf 170.238.160.191 port 52794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:51:05 host2 sshd[1177731]: Disconnected from invalid user sina 192.210.233.234 port 46616 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:50:15 host2 sshd[1177115]: Disconnected from invalid user git 34.22.66.183 port 35154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:50:32 host2 sshd[1177317]: Disconnected from invalid user db 134.209.101.17 port 46260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:51:13 host2 sshd[1177790]: Disconnected from invalid user tecnica 116.193.191.159 port 46346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:51:31 host2 sshd[1177943]: Disconnected from invalid user ftp_user 34.22.66.183 port 48264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:52:32 host2 sshd[1178854]: Disconnected from invalid user maman 43.163.123.45 port 46114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 11:52:51 host2 sshd[1179117]: Disconnected from invalid user ryan 64.226.96.54 port 43282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:53:22 host2 sshd[1179589]: Disconnected from invalid user nima 192.210.233.234 port 40438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 20 11:53:14 host2 sshd[1179484]: Disconnected from invalid user yf 144.48.8.10 port 59798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:53:20 host2 sshd[1179567]: Disconnected from invalid user code 134.209.101.17 port 38762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:53:44 host2 sshd[1179855]: Disconnected from invalid user payroll 36.95.194.54 port 55502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:53:51 host2 sshd[1179934]: Disconnected from invalid user rashid 116.193.191.159 port 40664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-20 11:54:09 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (pates) [82.32.230.230]:44337: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:55:53 host2 sshd[1182587]: Disconnected from invalid user cisco 192.210.233.234 port 45122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:56:46 host2 sshd[1183231]: Disconnected from invalid user git 36.95.194.54 port 58642 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:59:06 host2 sshd[1184460]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:58:35 host2 sshd[1184322]: Disconnected from invalid user marek 134.209.101.17 port 56350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.130.79
country_id: 2077456
description:
2025-11-20 11:58:57 dovecot_login authenticator failed for ([120.157.130.79]) [120.157.130.79]:44026: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:59:53 host2 sshd[1185031]: Disconnected from invalid user linuxadmin 36.95.194.54 port 54262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-20 11:59:33 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:34373: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 12:00:00 host2 sshd[1185081]: Disconnected from invalid user ssd 170.238.160.191 port 42146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-20 11:59:19 dovecot_login authenticator failed for ([182.79.35.233]) [128.185.215.38]:59700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:59:52 host2 sshd[1185017]: Disconnected from invalid user ryan 134.209.101.17 port 41180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 12:00:10 host2 sshd[1185411]: Disconnected from invalid user sina 64.226.96.54 port 38440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.30.161.197
country_id: 690791
description:
Nov 20 12:02:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng>, method=PLAIN, rip=46.30.161.197, lip=66.85.158.91, session=<5F6N3QBEq78uHqHF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.159.164.28
country_id: 294640
description:
Nov 20 12:02:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=85.159.164.28, lip=66.85.158.91, TLS, session=<8jz12wBEQdBVn6Qc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.255.202.56
country_id: 2413451
description:
Nov 20 12:03:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=197.255.202.56, lip=66.85.158.91, TLS, session=<X9rT3QBEwcLF/8o4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 12:04:33 host2 sshd[1188403]: Disconnected from invalid user ssd 64.226.96.54 port 59184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:05:18 host2 sshd[1188955]: Disconnected from invalid user vadim 138.68.97.135 port 55424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 12:06:36 host2 sshd[1189601]: Disconnected from invalid user debian 36.95.194.54 port 36464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:07:10 host2 sshd[1190000]: Disconnected from invalid user user 36.67.70.198 port 60910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:09:43 host2 sshd[1191478]: Disconnected from invalid user sgd 36.67.70.198 port 56444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:11:04 host2 sshd[1192485]: Disconnected from invalid user dev 138.68.97.135 port 56776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-20 12:11:00 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:54745: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-20 12:11:37 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:47058: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.85
country_id: 798544
description:
Nov 20 12:11:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.246.208.85, lip=66.85.158.91, TLS, session=<26Vp/QBE/Jdb9tBV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:11:20 host2 sshd[1192605]: Disconnected from invalid user code 36.67.70.198 port 54798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:13:06 host2 sshd[1193802]: Disconnected from invalid user user 138.68.97.135 port 45320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:14:10 host2 sshd[1194576]: Disconnected from invalid user sgd 138.68.97.135 port 35508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:14:42 host2 sshd[1194853]: Disconnected from invalid user odoo 36.67.70.198 port 59004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-20 12:15:54 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:56274: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-20 12:16:15 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:46525: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:17:09 host2 sshd[1196288]: Disconnected from invalid user ftpuser 181.23.52.22 port 51786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-20 12:23:00 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (hytionts) [73.13.220.220]:45042: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:24:15 host2 sshd[1200366]: Disconnected from invalid user light 181.23.52.22 port 56264 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:27:50 host2 sshd[1202504]: Disconnected from invalid user es 181.23.52.22 port 58720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov 20 12:36:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<2bV8VgFEQLbJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.252.229.77
country_id: 3865483
description:
Nov 20 12:37:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=201.252.229.77, lip=66.85.158.91, TLS, session=<NE63VwFEX6TJ/OVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.221
country_id: 6252001
description:
Nov 20 12:39:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Yy2SXwFEN8XN0h/d>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 12:50:35 host2 sshd[1219004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.177.100
country_id: 3469034
description:
Nov 20 12:52:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=200.77.177.100, lip=66.85.158.91, TLS, session=<fdIgjgFEmZDITbFk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.174
country_id: 953987
description:
Nov 20 12:52:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=102.64.32.174, lip=66.85.158.91, TLS, session=<boZkjwFETs1mQCCu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-11-20 12:59:24 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:36274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 13:02:53 host2 sshd[1227145]: Disconnected from invalid user jazmyne 62.60.131.157 port 25736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-20 13:07:41 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:51804: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Nov 20 13:07:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dR9oxgFE09HG6xh3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-11-20 13:07:17 dovecot_login authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:52248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:11:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<bnfE0QFEPIcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:11:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zewu1AFE1r0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:12:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9bpk1QFEfL8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:13:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4iW42QFEPpEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:14:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QBif3AFEqL4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:15:07 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<V/ww4AFEssQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:16:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qZmm5AFEtIkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:17:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DbbY6AFEMMUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:18:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R9Ca6wFEytcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:19:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<4DAy8AFEAKoDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-11-20 13:30:04 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:35186: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-20 13:30:30 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:60136: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.198
country_id: 3865483
description:
Nov 20 13:33:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.190.167.198, lip=66.85.158.91, TLS, session=<2dqUIQJE+Ku6vqfG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.41
country_id: 99237
description:
Nov 20 13:34:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.136.41, lip=66.85.158.91, TLS, session=<jc3HIgJEyIdBFIgp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 13:37:31 host2 sshd[1249143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.18
country_id: 226074
description:
Nov 20 13:40:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training@v-deploy.com>, method=PLAIN, rip=196.0.87.18, lip=66.85.158.91, TLS, session=<MKdYOwJE0c/EAFcS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.235
country_id: 298795
description:
Nov 20 13:41:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=45.67.155.235, lip=66.85.158.91, TLS, session=<DsarPAJEBs8tQ5vr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 13:41:39 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53506: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 161.35.105.100
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 161.35.105.100: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.116
country_id: 3865483
description:
Nov 20 13:54:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=138.0.184.116, lip=66.85.158.91, TLS, session=<avcSawJEHayKALh0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.177
country_id: 3469034
description:
Nov 20 13:54:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.36.202.177, lip=66.85.158.91, TLS, session=<d8ZdbAJEK8aKJMqx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.215
country_id: 3175395
description:
Nov 20 13:55:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=217.26.179.215, lip=66.85.158.91, TLS, session=<PlLEcAJEApLZGrPX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.196.139
country_id: 3865483
description:
Nov 20 13:56:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.96.196.139, lip=66.85.158.91, TLS, session=<SFrtcQJERqS6YMSL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 13:59:44 dovecot_login authenticator failed for (eBEH3Pw) [213.209.157.174]:63741: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 14:00:07 dovecot_login authenticator failed for (0iLzhX) [213.209.157.174]:60927: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 14:01:17 dovecot_login authenticator failed for (6CfsuDeSZ5) [213.209.157.174]:62864: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 20 14:01:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<g1SehgJE9oWLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Nov 20 14:03:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.70, lip=66.85.158.91, TLS, session=<BUj6iwJEsPmTuYRG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-20 14:04:12 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (boophated) [98.40.101.10]:47316: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.121.215
country_id: 2802361
description:
Nov 20 14:12:00 host2 pure-ftpd[1272910]: (?@35.240.121.215) [INFO] New connection from 35.240.121.215


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.130.33
country_id: 99237
description:
Nov 20 14:23:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=65.20.130.33, lip=66.85.158.91, TLS, session=<XoA10wJEHotBFIIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Nov 20 14:23:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=</Pp/1AJEbeIpixLe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:24:33 host2 sshd[1279843]: Disconnected from invalid user test 51.158.120.121 port 36654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:25:41 dovecot_login authenticator failed for (pkm3is) [121.237.41.41]:56400: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 20 14:25:13 host2 sshd[1280308]: Disconnected from invalid user stack 107.175.159.248 port 44720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:25:31 host2 sshd[1280497]: Disconnected from invalid user amir 51.158.120.121 port 42432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:26:07 dovecot_login authenticator failed for (wlo2fnd) [121.237.41.41]:56591: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:27:20 dovecot_login authenticator failed for (GHxzN26NE6) [121.237.41.41]:57580: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:29:46 host2 sshd[1283061]: Disconnected from invalid user runner 51.158.120.121 port 42416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 20 14:31:35 host2 sshd[1284110]: Disconnected from invalid user abbas 107.175.159.248 port 45016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:37:47 host2 sshd[1287873]: Disconnected from invalid user saga 52.169.142.214 port 58138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:39:37 host2 sshd[1288924]: Disconnected from invalid user admin 52.169.142.214 port 53000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:40:28 host2 sshd[1289521]: Disconnected from invalid user admin 185.77.225.203 port 46152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 14:40:55 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:57702: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:42:02 host2 sshd[1290349]: Disconnected from invalid user deniz 52.169.142.214 port 42498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-20 14:41:17 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:34196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:44:09 host2 sshd[1291581]: Disconnected from invalid user runner 185.77.225.203 port 45624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:44:28 host2 sshd[1291704]: Disconnected from invalid user raaj 52.169.142.214 port 50712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:46:24 host2 sshd[1293475]: Disconnected from invalid user raaj 185.77.225.203 port 45238 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 14:47:20 host2 sshd[1293984]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:48:38 host2 sshd[1294806]: Disconnected from invalid user script 185.77.225.203 port 44864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:49:43 host2 sshd[1295327]: Disconnected from invalid user flectra 185.77.225.203 port 44670 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-20 14:52:20 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:37307: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.18
country_id: 6252001
description:
2025-11-20 14:52:49 dovecot_login authenticator failed for ([98.181.63.18]) [98.181.63.18]:47387: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 20 14:54:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<gku3QgNEl/4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-20 14:58:49 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (sapheabi) [73.197.236.163]:34950: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 14:59:27 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<FiNRVQNE0qkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:01:08 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<3edXWwNEzuIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:03:18 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<noYSYwNEOLIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:03:19 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jkwrYwNEQrIDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.48
country_id: 3469034
description:
Nov 20 15:05:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.71.89.48, lip=66.85.158.91, TLS, session=<C0YBaQNE7eCxR1kw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.248
country_id: 3469034
description:
Nov 20 15:05:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.53.165.248, lip=66.85.158.91, TLS, session=<8PVNagNEFJqxNaX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.56
country_id: 798544
description:
Nov 20 15:08:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=91.231.122.56, lip=66.85.158.91, TLS, session=<jgS5dANEeuNb53o4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.85
country_id: 3175395
description:
Nov 20 15:08:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=171.22.234.85, lip=66.85.158.91, TLS, session=<IgbOdQNEAeWrFupV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.66.41.67
country_id: 3469034
description:
Nov 20 15:17:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.66.41.67, lip=66.85.158.91, TLS, session=<GpBXlANEZaqxQilD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.82
country_id: 3865483
description:
Nov 20 15:17:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.238.107.82, lip=66.85.158.91, TLS, session=<2a6RlQNE1YMt7mtS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-20 15:26:33 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:33394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-20 15:27:00 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:49040: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 15:34:01 host2 sshd[1325478]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 15:44:38 host2 sshd[1332007]: Disconnected from invalid user tacuser 45.78.226.12 port 51186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:45:10 host2 sshd[1332653]: Disconnected from invalid user tejas 89.235.118.35 port 36824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 15:47:01 host2 sshd[1334182]: Disconnected from invalid user donavan 62.60.131.157 port 27251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:48:48 host2 sshd[1335243]: Disconnected from invalid user es 89.235.118.35 port 48276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:49:16 host2 sshd[1335547]: Disconnected from invalid user noreply 51.77.245.237 port 57086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 15:49:31 host2 sshd[1335635]: Disconnected from invalid user ftpuser 200.89.178.151 port 28457 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:50:14 host2 sshd[1336377]: Disconnected from invalid user newusername 89.235.118.35 port 48106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-20 15:51:50 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:36402: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-20 15:51:32 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:32858: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:52:35 host2 sshd[1338240]: Disconnected from invalid user admin 51.77.245.237 port 55866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 15:52:58 host2 sshd[1338628]: Disconnected from invalid user tidb 200.89.178.151 port 35588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:53:38 host2 sshd[1339327]: Disconnected from invalid user family 51.77.245.237 port 55458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:54:21 host2 sshd[1340024]: Disconnected from invalid user elasticuser 89.235.118.35 port 60868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:54:36 host2 sshd[1340442]: Disconnected from invalid user frank 51.77.245.237 port 55050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:01:15 host2 sshd[1346546]: Disconnected from invalid user frank 45.78.226.12 port 50500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.158
country_id: 3469034
description:
Nov 20 16:01:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.247.158, lip=66.85.158.91, TLS, session=<HMP1MQREncG60fee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.91
country_id: 3175395
description:
Nov 20 16:01:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.179.91, lip=66.85.158.91, TLS, session=<iD7UMAREds7ZGrNb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:03:44 host2 sshd[1349149]: Disconnected from invalid user art 45.78.226.12 port 54256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 16:03:09 host2 sshd[1348265]: Disconnected from invalid user ftpu 200.89.178.151 port 56985 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:03:25 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<y34aOgREysQDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.54
country_id: 241170
description:
Nov 20 16:04:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.232.94.54, lip=66.85.158.92, TLS handshaking: Connection closed, session=<U5IzPgREDi6c6F42>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:05:12 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<+UF3QAREWJwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:06:56 host2 sshd[1351787]: Disconnected from invalid user shared 122.155.223.2 port 51257 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:07:04 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Py8rRwREQoIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 20 16:07:24 host2 sshd[1352109]: Disconnected from invalid user client 45.78.223.11 port 54334 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:07:49 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<0I/WSQREzsgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 20 16:09:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<xgSWTgREeBNChJl3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:09:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<NT4zTwRE4IsDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:10:19 host2 sshd[1354562]: Disconnected from invalid user test 103.52.115.223 port 45094 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:10:38 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<EEXoUwRE4J4DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:11:29 host2 sshd[1355395]: Disconnected from invalid user null 45.78.226.12 port 40850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:11:57 host2 sshd[1355748]: Disconnected from invalid user jorge 103.52.115.223 port 53440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:11:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<NmSfVQREJKgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:12:08 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<g55KWQREQqcDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:12:25 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<6fxDWgREBsUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:13:47 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<8GMoXwRExNoDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:15:01 host2 sshd[1358144]: Disconnected from invalid user ubuntu22 103.52.115.223 port 50266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:15:13 host2 sshd[1358470]: Disconnected from invalid user ankur 198.12.77.137 port 58782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:16:26 host2 sshd[1359329]: Disconnected from invalid user noreply 45.78.226.12 port 41220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:16:46 host2 sshd[1359614]: Disconnected from invalid user jira 62.97.44.51 port 56702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:17:22 host2 sshd[1360095]: Disconnected from invalid user jorge 198.12.77.137 port 42660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:17:07 host2 sshd[1359915]: Disconnected from invalid user admin 128.1.44.115 port 57880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:19:14 host2 sshd[1361350]: Disconnected from invalid user ankur 160.251.251.171 port 47580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:19:38 host2 sshd[1361705]: Disconnected from invalid user long 103.52.115.223 port 36186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.19
country_id: 3175395
description:
Nov 20 16:19:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.63.133.19, lip=66.85.158.91, TLS, session=<UWezcwREZN65P4UT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:20:49 host2 sshd[1362758]: Disconnected from invalid user arif 62.97.44.51 port 40414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.24
country_id: 798544
description:
Nov 20 16:20:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.125.4.24, lip=66.85.158.91, TLS, session=<VqbEdARE/6e5fQQY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:21:08 host2 sshd[1362973]: Disconnected from invalid user node1 160.251.251.171 port 33450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:21:32 host2 sshd[1363263]: Disconnected from invalid user epadmin 198.12.77.137 port 43332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:21:53 host2 sshd[1363484]: Disconnected from invalid user casa 62.97.44.51 port 34152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:22:58 host2 sshd[1364187]: Disconnected from invalid user ansadmin 62.97.44.51 port 49976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 20 16:23:23 host2 sshd[1364529]: Disconnected from invalid user admin 45.78.223.11 port 34580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:24:53 host2 sshd[1365688]: Disconnected from invalid user xyh 160.251.251.171 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:24:28 host2 sshd[1365452]: Disconnected from invalid user csgoserver 110.78.149.76 port 46750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:24:37 host2 sshd[1365527]: Disconnected from invalid user rizzo 103.166.187.238 port 55398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:25:13 host2 sshd[1366036]: Disconnected from invalid user chrome 62.97.44.51 port 52748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:25:19 host2 sshd[1366141]: Disconnected from invalid user xyh 122.155.223.2 port 44781 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:25:58 host2 sshd[1366656]: Disconnected from invalid user jira 103.166.187.238 port 54796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:26:07 host2 sshd[1366786]: Disconnected from invalid user egarcia 128.1.44.115 port 35904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:27:18 host2 sshd[1367535]: Disconnected from invalid user git 103.166.187.238 port 49464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:27:23 host2 sshd[1367594]: Disconnected from invalid user hyper 122.155.223.2 port 26005 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:27:25 host2 sshd[1367613]: Disconnected from invalid user steam 128.1.44.115 port 46108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:28:39 host2 sshd[1368496]: Disconnected from invalid user reza 160.251.251.171 port 42610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:28:45 host2 sshd[1368554]: Disconnected from invalid user dev 128.1.44.115 port 47812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:28:13 host2 sshd[1368214]: Disconnected from invalid user admin 31.193.128.244 port 51184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:29:15 host2 sshd[1368895]: Disconnected from invalid user ubuntu 110.78.149.76 port 33604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:30:52 host2 sshd[1370398]: Disconnected from invalid user steam 110.78.149.76 port 48876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:32:11 host2 sshd[1371293]: Disconnected from invalid user ganesh 189.30.117.80 port 36696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:32:49 host2 sshd[1371686]: Disconnected from invalid user paco 31.193.128.244 port 34238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:33:35 host2 sshd[1372099]: Disconnected from invalid user steam 189.30.117.80 port 47666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov 20 16:33:09 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, session=<hflrpAREvMunXpI6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:35:06 host2 sshd[1373369]: Disconnected from invalid user admin 31.193.128.244 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:34:18 host2 sshd[1372616]: Disconnected from invalid user laravel 189.30.117.80 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:35:06 host2 sshd[1373362]: Disconnected from invalid user kdh 179.216.23.19 port 45459 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:35:46 host2 sshd[1373938]: Disconnected from invalid user carla 110.78.149.76 port 59102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:38:35 host2 sshd[1376078]: Disconnected from invalid user dev 31.193.128.244 port 35606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:39:29 host2 sshd[1376742]: Disconnected from invalid user guest 179.216.23.19 port 1885 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:41:29 host2 sshd[1378671]: Disconnected from invalid user donavan 62.60.131.157 port 24855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:41:33 host2 sshd[1378748]: Disconnected from invalid user actions 179.216.23.19 port 1903 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 16:44:18 host2 sshd[1380842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:44:21 host2 sshd[1380868]: Disconnected from invalid user r00t 188.247.31.91 port 49167 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 20 16:44:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<7q1ZzQREzoWUcdUX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:45:44 host2 sshd[1382640]: Disconnected from invalid user admin 188.247.31.91 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 16:48:59 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:46248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:48:21 host2 sshd[1384688]: Disconnected from invalid user dev 101.47.143.192 port 36560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 16:49:16 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (matande) [81.225.30.107]:51426: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-20 16:49:48 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:34995: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:50:49 host2 sshd[1386792]: Disconnected from invalid user yusuf 101.47.143.192 port 34062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:55:42 host2 sshd[1391162]: Disconnected from invalid user bitwarden 101.47.143.192 port 51160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:59:26 host2 sshd[1394075]: Disconnected from invalid user draven 62.60.131.157 port 15555 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.224
country_id: 953987
description:
Nov 20 17:02:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=102.129.54.224, lip=66.85.158.91, TLS, session=<7ch/DQVE181mgTbg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.241
country_id: 3469034
description:
Nov 20 17:02:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.96.241, lip=66.85.158.91, TLS, session=<q5BLDAVEbq6xLGDx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-20 17:04:01 dovecot_plain authenticator failed for (scumnodied) [64.72.74.162]:45616: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2025-11-20 17:08:24 dovecot_plain authenticator failed for (wynon) [195.133.156.119]:43867: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.147
country_id: 3469034
description:
Nov 20 17:18:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=138.36.202.147, lip=66.85.158.91, TLS, session=<QwfoRgVEYtuKJMqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Nov 20 17:19:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<85csSAVE+hDI7VWg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:25:23 host2 sshd[1416626]: Disconnected from invalid user rex 194.105.81.37 port 46194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:29:42 host2 sshd[1420418]: Disconnected from invalid user dns 45.205.30.37 port 41576 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 17:31:09 host2 sshd[1421701]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:33:07 host2 sshd[1423543]: Disconnected from invalid user bitcoin 45.205.30.37 port 38216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-20 17:33:46 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:59348: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-20 17:34:34 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:39590: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:34:34 host2 sshd[1424851]: Disconnected from invalid user victor 194.105.81.37 port 48398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.157.32
country_id: 337996
description:
2025-11-20 17:34:59 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:35:27 host2 sshd[1425822]: Disconnected from invalid user info 45.205.30.37 port 41420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-20 17:35:18 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:40790: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:36:47 host2 sshd[1426831]: Disconnected from invalid user chrome 194.105.81.37 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:37:43 host2 sshd[1427831]: Disconnected from invalid user yousef 45.205.30.37 port 49206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:38:54 host2 sshd[1428877]: Disconnected from invalid user sbot 45.205.30.37 port 33356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-20 17:45:56 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (tedlembed) [73.68.220.15]:38668: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-20 17:48:19 dovecot_plain authenticator failed for (gited) [12.150.243.22]:3812: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Nov 20 17:58:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<gXic1QVEv9cfs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.120
country_id: 798544
description:
Nov 20 17:59:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.101.120, lip=66.85.158.91, TLS, session=<M2Sx1gVEeNyy22V4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-20 18:03:14 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (hellinecty) [71.224.169.28]:57942: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-20 18:06:04 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:37864: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 18:11:26 host2 sshd[1461484]: Disconnected from invalid user jameson 62.60.131.157 port 21214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.222
country_id: 3996063
description:
2025-11-20 18:15:03 dovecot_login authenticator failed for ([201.172.88.222]) [201.172.88.222]:48918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Nov 20 18:15:36 host2 pure-ftpd[1464749]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.175
country_id: 798544
description:
Nov 20 18:18:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=109.125.247.175, lip=66.85.158.91, TLS, session=<X21cHQZEIbBtffev>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.200
country_id: 3077311
description:
Nov 20 18:19:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.163.38.200, lip=66.85.158.91, TLS, session=<1I2eHgZEupRVoybI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 18:24:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59471: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.89.179.43
country_id: 6252001
description:
Nov 20 18:25:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=35.89.179.43, lip=66.85.158.91, TLS: Connection closed, session=<FcDUNwZE8NcjWbMr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.176.214.185
country_id: 6252001
description:
Nov 20 18:35:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.176.214.185, lip=66.85.158.91, TLS: Connection closed, session=<RQmiWgZEwsE2sNa5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.7
country_id: 3865483
description:
Nov 20 18:40:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.89.7, lip=66.85.158.91, TLS, session=<C+hoawZER8W+tVkH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 20 18:40:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<7uSdbAZE/bOynG0e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 18:42:15 host2 sshd[1485268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.120
country_id: 3469034
description:
Nov 20 18:42:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.250.120, lip=66.85.158.91, TLS, session=<ThwycQZE9MG60fp4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.90.2.146
country_id: 798544
description:
Nov 20 18:42:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=45.90.2.146, lip=66.85.158.91, TLS, session=<xZNjcgZE/8MtWgKS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:45:10 host2 sshd[1488037]: Disconnected from invalid user admin 107.172.146.104 port 60182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:46:08 host2 sshd[1488688]: Disconnected from invalid user guest 51.222.106.104 port 42612 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<sLPWgwZECuzPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<0PbagwZE3r3PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:48:28 host2 sshd[1490400]: Disconnected from invalid user user 51.222.106.104 port 60080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:49:21 host2 sshd[1491061]: Disconnected from invalid user elena 107.172.146.104 port 43944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:49:42 host2 sshd[1491500]: Disconnected from invalid user andre 51.222.106.104 port 36972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-20 18:50:53 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (mentiantly) [81.226.88.121]:35104: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.254.74.120
country_id: 6252001
description:
Nov 20 18:51:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=44.254.74.120, lip=66.85.158.92, TLS: Connection closed, session=<VCzNkgZESqks/kp4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:51:38 host2 sshd[1493231]: Disconnected from invalid user andre 107.172.146.104 port 37572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:57:19 host2 sshd[1498548]: Disconnected from invalid user front 51.222.106.104 port 44982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.222.104.59
country_id: 6252001
description:
Nov 20 18:58:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=34.222.104.59, lip=66.85.158.92, TLS: Connection closed, session=<RYveqgZEJroi3mg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-20 18:58:12 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (ancers) [68.60.77.128]:53340: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-20 18:59:04 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-20 18:59:15 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:02:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dr5WugZEyo0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:03:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<d7qJvgZElOIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:05:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<3k5LxQZEsMgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:07:24 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<DtkPzAZETqADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.190
country_id: 3469034
description:
Nov 20 19:10:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.246.190, lip=66.85.158.91, TLS, session=<jgiC1AZEVZ+60fa+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.246
country_id: 6290252
description:
Nov 20 19:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=109.207.34.246, lip=66.85.158.91, TLS, session=<z0ti0wZErrNtzyL2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:10:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<y4ne1QZEeNYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:11:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<333H2wZElOUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.92, session=<YcWR4AZEPT/OvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.67.48
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.67.48, lip=66.85.158.92, session=<OYWY4AZEkGaGekMw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 20 19:16:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS, session=<IJHr7AZEMvKl6Er8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:20:07 host2 sshd[1517644]: Disconnected from invalid user public 45.78.220.116 port 37134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov 20 19:21:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.91, TLS: Connection closed, session=<Pp4w/QZEtMyUccFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.128.246.187
country_id: 6252001
description:
Nov 20 19:21:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=138.128.246.187, lip=66.85.158.91, TLS: Connection closed, session=<MA0LAAdEvzKKgPa7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-20 19:25:17 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:40736: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-20 19:25:27 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:46673: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:25:49 host2 sshd[1522211]: Disconnected from invalid user user1 198.1.117.220 port 43674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:29:01 host2 sshd[1523883]: Disconnected from invalid user user 198.1.117.220 port 50264 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 19:29:37 host2 sshd[1524339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-20 19:31:05 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:59536: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-20 19:31:24 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:48786: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:33:47 host2 sshd[1527605]: Disconnected from invalid user app 198.1.117.220 port 49818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:35:06 host2 sshd[1528653]: Disconnected from invalid user user3 45.78.220.116 port 40594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.101.69
country_id: 3057568
description:
Nov 20 19:37:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=31.134.101.69, lip=66.85.158.91, TLS, session=<HjmpNgdEw+MfhmVF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.0.105.88
country_id: 2510769
description:
Nov 20 19:37:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.0.105.88, lip=66.85.158.91, TLS, session=<GD67NwdEl8ElAGlY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.106
country_id: 3996063
description:
Nov 20 19:39:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=38.65.137.106, lip=66.85.158.91, TLS, session=<F5+APAdEq8kmQYlq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Nov 20 19:39:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<Ln+iPQdEkKEr5eEz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.166.146
country_id: 6251999
description:
Nov 20 19:53:54 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=137.184.166.146, lip=66.85.158.91, TLS, session=<CXNkcgdExuiJuKaS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 19:57:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OlROfwdEQuii2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 19:57:36 host2 sshd[1547596]: Disconnected from invalid user ftp1 152.32.129.140 port 24572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:00:30 host2 sshd[1550180]: Disconnected from invalid user odoo 85.133.237.167 port 37222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:01:26 host2 sshd[1550836]: Disconnected from invalid user dan 152.32.129.140 port 24936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 20:01:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS, session=<8ETKjgdEruGi2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:02:53 host2 sshd[1552023]: Disconnected from invalid user mc2 85.133.237.167 port 33086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:02:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Q81XkgdESJkI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 20:03:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<AdbIlQdEssRSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 20:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<SlM9mgdERUMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:05:34 host2 sshd[1554637]: Disconnected from invalid user ubuntu 152.32.129.140 port 54236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:05:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<xsBdnQdEKrdn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:05:10 host2 sshd[1554371]: Disconnected from invalid user karim 51.178.141.222 port 35424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:05:19 host2 sshd[1554505]: Disconnected from invalid user es 79.112.19.63 port 51286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-20 20:06:47 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:42464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:06:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<J//voAdEZIIjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:06:16 host2 sshd[1555161]: Disconnected from invalid user xxx 51.178.141.222 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:06:26 host2 sshd[1555268]: Disconnected from invalid user bad 85.133.237.167 port 40460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:07:35 host2 sshd[1556051]: Disconnected from invalid user incoming 85.133.237.167 port 47974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-20 20:07:38 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:34506: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:08:43 host2 sshd[1556777]: Disconnected from invalid user emo 85.133.237.167 port 36616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:09:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<6URrqAdEvueLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:09:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<tU49qwdEfHxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 20:10:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=</z08rQdEhpCYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:10:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<KtMdrgdEdlgI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:11:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<YrwOsAdE9tOLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:11:29 host2 sshd[1558693]: Disconnected from invalid user red 79.112.19.63 port 34718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:11:46 host2 sshd[1558844]: Disconnected from invalid user red 51.178.141.222 port 60932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 20 20:11:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=8.216.40.228, lip=66.85.158.91, session=<cB6ysgdE5tQI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.25.110.103
country_id: 2635167
description:
Nov 20 20:11:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=82.25.110.103, lip=66.85.158.91, session=<0FvIsgdE4L1SGW5n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.140
country_id: 798544
description:
Nov 20 20:12:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.246.209.140, lip=66.85.158.91, TLS, session=<xBywswdEgdNb9tGM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:12:36 host2 sshd[1559353]: Disconnected from invalid user test 110.93.250.15 port 46658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.16
country_id: 3469034
description:
Nov 20 20:12:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.37.16, lip=66.85.158.91, TLS, session=<8JLHtAdEsI2/8CUQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:13:33 host2 sshd[1560062]: Disconnected from invalid user steam 152.32.129.140 port 57832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:13:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<AVfNuAdELL0I3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:14:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Q9A5vQdEBNai2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 20:15:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<oWH4vwdEWIaUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:15:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<K0m9wAdEfPui2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:15:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<fLj1vgdEpqQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:15:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<ljNFvwdE/Lln76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 20:16:47 host2 sshd[1562027]: Disconnected from invalid user alycia 62.60.131.157 port 8471 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:17:15 host2 sshd[1562341]: Disconnected from invalid user user 110.93.250.15 port 13173 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 20:17:19 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pergulae) [81.225.30.107]:39823: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:18:22 host2 sshd[1562978]: Disconnected from invalid user devuser 79.112.19.63 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:18:49 host2 sshd[1563183]: Disconnected from invalid user dan 110.93.250.15 port 23328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 20:19:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<0P0RzAdEGJkv+1FF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 20:19:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oS+jzAdEiN6l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:19:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS, session=<mkjNzQdEou+i2JZk>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 20:22:51 host2 sshd[1566224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:22:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<Nqjd2AdEtONrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:22:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<a5Cy2QdEarQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 20:23:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Y4OR2wdEQJAv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 20 20:23:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<dC073QdECMOH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-11-20 20:24:48 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:17414: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 20:24:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+VUA4QdEUoSPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-20 20:24:22 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:33022: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 20:26:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wf0/5QdE+LUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 20:26:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<zOpF5wdEINpn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-20 20:27:46 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (andapsyper) [98.192.114.251]:50798: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:27:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Mfok7AdERIII2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 20 20:30:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<9QjC9AdEGrpe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 20:30:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<85Xh9AdEMs5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 20:30:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<0mJw9gdEgKwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:33:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<dYUl/wdE0Mho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 20:35:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<b/HGBghEsJuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 20:35:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<A/SRBwhE4O3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:37:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<ZkmJDAhEIMBrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-20 20:38:05 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:38748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:39:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wGjPEwhEYqcjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-20 20:38:43 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:56401: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.114
country_id: 298795
description:
Nov 20 20:42:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=95.0.32.114, lip=66.85.158.91, TLS, session=<qadvHQhEjpBfACBy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:41:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9midGwhEoswI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Nov 20 20:42:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<cfATHwhEMqLEAHqi>


