# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:13:18 host2 sshd[2046129]: Disconnected from invalid user foundry 38.137.11.10 port 10612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 28 21:15:52 host2 sshd[2047773]: Disconnected from invalid user dockeradmin 50.225.176.238 port 52746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:18:15 host2 sshd[2048966]: Disconnected from invalid user liyang 194.74.196.10 port 47956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 28 21:19:02 host2 sshd[2049343]: Disconnected from invalid user ts2 50.225.176.238 port 40806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:19:21 host2 sshd[2049521]: Disconnected from invalid user manager 194.74.196.10 port 43384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:22:35 host2 sshd[2051419]: Disconnected from invalid user proxyuser 194.74.196.10 port 57122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:22:42 host2 sshd[2051447]: Disconnected from invalid user usuario2 38.137.11.10 port 4676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.74.196.10
country_id: 2635167
description:
Nov 28 21:23:34 host2 sshd[2051887]: Disconnected from invalid user devuser 194.74.196.10 port 33672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-28 21:23:55 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (ideric) [73.196.144.25]:45140: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 21:26:08 dovecot_plain authenticator failed for (ZZ7H17CIG) [45.244.98.249]:53775: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 21:26:14 dovecot_login authenticator failed for (ZZ7H17CIG) [45.244.98.249]:53775: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 21:28:35 host2 sshd[2055788]: Disconnected from invalid user cornelius 62.60.131.157 port 37143 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 28 21:29:29 host2 sshd[2056393]: Disconnected from invalid user kapsch 38.137.11.10 port 41422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.110
country_id: 3144096
description:
2025-11-28 21:30:34 dovecot_login authenticator failed for (ADMIN) [46.246.122.110]:49967: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.70.47
country_id: 1269750
description:
2025-11-28 21:34:52 dovecot_plain authenticator failed for (Z69Q27X) [106.76.70.47]:57582: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.158.177
country_id: 3469034
description:
2025-11-28 21:37:01 dovecot_login authenticator failed for ([191.59.158.177]) [191.59.158.177]:46138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-28 21:37:22 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3455: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 21:38:14 host2 sshd[2062850]: Disconnected from invalid user techuser 187.251.132.2 port 41716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-28 21:42:02 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:47948: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-28 21:41:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.9
country_id: 2635167
description:
2025-11-28 21:44:48 dovecot_login authenticator failed for (ADMIN) [158.173.23.9]:1323: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 28 21:50:21 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<N0WTAapEYE64affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.6
country_id: 3042225
description:
2025-11-28 21:59:21 dovecot_login authenticator failed for (ADMIN) [91.90.124.6]:23285: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 21:59:44 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pSYXI6pEItKi2Jby>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 22:00:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<0MRsJqpE+O2i2Jby>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 28 22:00:20 host2 pure-ftpd[2089274]: (?@66.132.153.118) [INFO] New connection from 66.132.153.118


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 22:01:10 host2 sshd[2089653]: Disconnected from invalid user rstudio 187.251.132.2 port 51980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:02:23 host2 sshd[2090216]: Disconnected from invalid user kingbase 103.117.56.152 port 46642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.177
country_id: 1880251
description:
Nov 28 22:02:31 host2 sshd[2090248]: Disconnected from invalid user usuario1 45.78.205.177 port 54992 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 28 22:03:52 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RKXkMapEOGNAPpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov 28 22:04:10 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZB31MqpEqNVAPpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.242
country_id: 6252001
description:
Nov 28 22:04:20 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.242, lip=66.85.158.92, TLS, session=<EgCJM6pE+Oii2Jby>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:05:12 host2 sshd[2092583]: Disconnected from invalid user amssys 103.117.56.152 port 43746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 28 22:07:50 host2 sshd[2093896]: Disconnected from invalid user qwerty 103.117.56.152 port 58438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-28 22:07:28 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (excloored) [196.47.172.253]:48874: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov 28 22:09:14 host2 sshd[2094874]: Disconnected from invalid user john 187.251.132.2 port 59444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 28 22:09:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<H+8jRqpEbw1RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:10:06 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<H5s0SKpEVKQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:11:11 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<i7UOTKpEnsQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:12:18 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ke4QUKpE/sEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-28 22:12:44 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:47370: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-28 22:13:15 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:46816: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:13:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<gFKLU6pEVr8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-28 22:13:12 dovecot_login authenticator failed for ([182.95.177.78]) [182.95.177.78]:37678: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.247.126
country_id: 290557
description:
2025-11-28 22:13:28 dovecot_login authenticator failed for ([94.207.247.126]) [94.207.247.126]:53494: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-11-28 22:14:18 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:42344: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:15:40 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=</vsXXKpEVoMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.149
country_id: 3077311
description:
2025-11-28 22:16:43 dovecot_login authenticator failed for (ADMIN) [212.102.39.149]:51700: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:16:43 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<GOneX6pE0MoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:17:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<Yt8NY6pERr8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:18:42 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<+UT0ZqpE/pIDgmBb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.31.127.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.31.127.65 - cloudtourssrilanka "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:19:05 host2 dovecot[1796015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5w5TaKpEGpkDgmBb>


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 34.31.127.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 34.31.127.65 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:20:10 host2 dovecot[1796015]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<VM0zbKpEqJQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-28 22:20:17 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:40630: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-28 22:20:20 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:45473: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-28 22:20:29 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:55923: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-28 22:20:30 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:44020: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:21:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nyg0cKpExN0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 28 22:22:18 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<xgrVc6pENrADgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.244.98.249
country_id: 357994
description:
2025-11-28 22:22:31 dovecot_plain authenticator failed for (T8FWR3M6R) [45.244.98.249]:60480: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 22:23:50 host2 sshd[2103586]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.223.21.182
country_id: 6252001
description:
Nov 28 22:24:29 host2 pure-ftpd[2104230]: (?@44.223.21.182) [INFO] New connection from 44.223.21.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:30:55 host2 sshd[2107998]: Disconnected from invalid user oracle 38.213.63.12 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:32:10 host2 sshd[2108583]: Disconnected from invalid user conectar 38.213.63.12 port 58548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 22:32:36 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<r5KKmKpEJNEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:32:43 host2 sshd[2108849]: Disconnected from invalid user bitrix 35.244.25.124 port 49842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-28 22:34:56 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:40750: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:35:50 host2 sshd[2110662]: Disconnected from invalid user intel 35.244.25.124 port 49324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-28 22:35:17 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:41862: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:35:36 host2 sshd[2110547]: Disconnected from invalid user git 38.213.63.12 port 42204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 22:37:40 host2 sshd[2111517]: Disconnected from invalid user admin 2.57.121.112 port 47985 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:38:42 host2 sshd[2112025]: Disconnected from invalid user intel 35.244.25.124 port 47156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 28 22:39:10 host2 sshd[2112318]: Disconnected from invalid user admin 38.213.63.12 port 33638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.173.18
country_id: 2921044
description:
2025-11-28 22:40:28 dovecot_login authenticator failed for (ADMIN) [181.214.173.18]:48784: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.218
country_id: 6252001
description:
Nov 28 22:41:11 host2 pure-ftpd[2113917]: (?@198.235.24.218) [INFO] New connection from 198.235.24.218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.244.25.124
country_id: 1269750
description:
Nov 28 22:41:24 host2 sshd[2114039]: Disconnected from invalid user es 35.244.25.124 port 44984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.66
country_id: 6252001
description:
Nov 28 22:43:03 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.66, lip=66.85.158.91, session=<i2ICvqpEpYxomDRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.177
country_id: 1880251
description:
Nov 28 22:43:50 host2 sshd[2115339]: Disconnected from invalid user andy 45.78.205.177 port 39106 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.25
country_id: 6252001
description:
Nov 28 22:48:05 host2 pure-ftpd[2120754]: (?@198.235.24.25) [INFO] New connection from 198.235.24.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-28 22:47:54 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:41274: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-28 22:48:16 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-28 22:55:00 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:53519: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-28 22:56:41 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:51170: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-28 22:56:21 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:45547: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-28 22:57:25 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:52999: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.126
country_id: 6252001
description:
Nov 28 22:58:32 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.97.5.126, lip=66.85.158.92, session=<LK5e9apEULISYQV+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.144
country_id: 798549
description:
2025-11-28 22:59:24 dovecot_login authenticator failed for (ADMIN) [91.90.120.144]:35334: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 23:00:10 host2 sshd[2130339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.132
country_id: 6252001
description:
Nov 28 23:03:33 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HrJPB6tEPsMs3LyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-28 23:10:13 dovecot_plain authenticator failed for (tutchen) [154.144.243.93]:35430: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:14:52 dovecot_login authenticator failed for (6rDqP2H) [178.16.54.97]:58406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:15:16 dovecot_login authenticator failed for (ql6PtBs) [178.16.54.97]:63149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.17
country_id: 390903
description:
2025-11-28 23:15:58 dovecot_login authenticator failed for (ADMIN) [79.127.181.17]:9015: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-11-28 23:16:50 dovecot_login authenticator failed for (z7saXh7) [178.16.54.97]:65437: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-28 23:24:23 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (cullo) [81.226.88.121]:47250: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov 28 23:25:57 host2 pure-ftpd[2150585]: (?@64.62.156.162) [INFO] New connection from 64.62.156.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:27:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<54y2XatEYsyi2JW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:28:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<PrUlYatEAuOi2JW7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.82.240
country_id: 1269750
description:
2025-11-28 23:29:59 dovecot_login authenticator failed for (static.ill.117.247.82.240.bsnl.co.in) [117.247.82.240]:47172: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.94.154
country_id: 1269750
description:
2025-11-28 23:30:11 dovecot_login authenticator failed for ([218.248.0.242]) [14.102.94.154]:42196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-28 23:32:09 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54343: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.35
country_id: 953987
description:
2025-11-28 23:33:36 dovecot_login authenticator failed for (ADMIN) [154.47.30.35]:59405: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 28 23:35:00 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<8gvQd6tEkL1ChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.187
country_id: 6252001
description:
Nov 28 23:35:57 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.187, lip=66.85.158.91, TLS, session=<SMo4e6tEivii2JW7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-28 23:37:22 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:34925: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.174.134.37
country_id: 1269750
description:
2025-11-28 23:44:35 dovecot_plain authenticator failed for ([192.168.1.5]) [122.174.134.37]:62024: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:45:38 host2 sshd[2163717]: Disconnected from invalid user bitnami 40.115.18.231 port 59670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:45:51 host2 sshd[2163823]: Disconnected from invalid user desliga 191.189.28.204 port 55856 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.220
country_id: 6252001
description:
Nov 28 23:46:06 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.220, lip=66.85.158.92, session=<y3mBn6tEfsas7OTc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:46:39 host2 sshd[2164290]: Disconnected from invalid user admin1 172.173.103.90 port 49940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:46:54 host2 sshd[2164491]: Disconnected from invalid user lab 123.58.212.133 port 51240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:48:34 host2 sshd[2165444]: Disconnected from invalid user deploy 191.189.28.204 port 50988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.195
country_id: 1210997
description:
2025-11-28 23:48:23 dovecot_plain authenticator failed for (Q171B58071) [103.115.252.195]:51776: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:49:35 host2 sshd[2166118]: Disconnected from invalid user mika 155.94.170.106 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:49:16 host2 sshd[2165818]: Disconnected from invalid user sftpuser 40.115.18.231 port 50276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:50:14 host2 sshd[2166684]: Disconnected from invalid user username 191.189.28.204 port 52104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:50:21 host2 sshd[2166768]: Disconnected from invalid user bot 172.173.103.90 port 51058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:50:24 host2 sshd[2166785]: Disconnected from invalid user bob 40.115.18.231 port 52226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:50:32 host2 sshd[2166847]: Disconnected from invalid user operador 123.58.212.133 port 47818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:50:35 host2 sshd[2166883]: Disconnected from invalid user dd 155.94.170.106 port 59574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 28 23:51:46 host2 sshd[2167501]: Disconnected from invalid user panda 123.58.212.133 port 51748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.40
country_id: 6252001
description:
2025-11-28 23:51:31 dovecot_login authenticator failed for (ADMIN) [173.244.56.40]:42258: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.127
country_id: 6252001
description:
Nov 28 23:51:38 host2 pure-ftpd[2167432]: (?@198.235.24.127) [INFO] New connection from 198.235.24.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:51:37 host2 sshd[2167420]: Disconnected from invalid user valheim 155.94.170.106 port 58118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 28 23:52:42 host2 sshd[2167985]: Disconnected from invalid user deploy 155.94.170.106 port 56668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 28 23:52:52 host2 sshd[2168054]: Disconnected from invalid user daniel 40.115.18.231 port 56124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:53:43 host2 sshd[2168624]: Disconnected from invalid user blue 191.189.28.204 port 55934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 23:53:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57329: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.103.90
country_id: 6252001
description:
Nov 28 23:54:20 host2 sshd[2169252]: Disconnected from invalid user ivan 172.173.103.90 port 33702 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.221.58.154
country_id: 6252001
description:
Nov 28 23:56:04 host2 pure-ftpd[2170512]: (?@20.221.58.154) [INFO] New connection from 20.221.58.154


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.189.28.204
country_id: 3469034
description:
Nov 28 23:55:29 host2 sshd[2170248]: Disconnected from invalid user bodega 191.189.28.204 port 33986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov 28 23:57:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.241, lip=66.85.158.92, TLS, session=<xKJ+yatE5P7N0h/x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.106.30.11
country_id: 3996063
description:
2025-11-28 23:59:26 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [201.106.30.11]:56494: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.8
country_id: 2750405
description:
Nov 28 23:59:29 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 2 secs): user=<>, rip=31.14.32.8, lip=66.85.158.92, TLS, session=<W/5hz6tEp9YfDiAI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-11-29 00:06:34 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (meteram) [68.40.189.43]:45464: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-29 00:07:41 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:36886: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.86
country_id: 3144096
description:
2025-11-29 00:08:35 dovecot_login authenticator failed for (ADMIN) [46.246.122.86]:57573: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.60
country_id: 6252001
description:
Nov 29 00:13:30 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KGGHAaxE6d2TuYQ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-29 00:13:59 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:46140: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-11-29 00:14:12 dovecot_login authenticator failed for (182.239.80.71.hk.chinamobile.com) [182.239.80.71]:59688: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-29 00:13:24 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (xaeduns) [73.176.157.57]:55268: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-29 00:17:23 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:44240: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-29 00:17:38 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:36576: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:18:59 host2 sshd[2186371]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 00:25:21 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<FaTDK6xEhIYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.222.185.101
country_id: 1880251
description:
Nov 29 00:25:48 host2 sshd[2191453]: Disconnected from invalid user dockeradmin 8.222.185.101 port 54548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:26:59 host2 sshd[2192042]: Disconnected from invalid user vyos 181.212.81.228 port 56568 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:28:47 host2 sshd[2192859]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-29 00:29:55 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:43623: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 29 00:33:17 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, session=<Zg48SKxENmenXpI2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:33:35 host2 sshd[2196489]: Disconnected from invalid user seafile 181.212.81.228 port 46648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2025-11-29 00:37:49 dovecot_login authenticator failed for (ADMIN) [185.225.28.227]:60311: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:37:35 host2 sshd[2199151]: Disconnected from invalid user user5 181.212.81.228 port 42640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-29 00:38:50 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (nonaisum) [73.197.194.98]:56812: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:38:55 host2 sshd[2199772]: Disconnected from invalid user Test 181.212.81.228 port 41300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Nov 29 00:45:41 host2 sshd[2204672]: Disconnected from invalid user public 181.212.81.228 port 34622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-29 00:49:53 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:58008: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 00:50:48 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:45095: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-29 00:51:17 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:57318: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.19
country_id: 2562770
description:
2025-11-29 00:52:40 dovecot_login authenticator failed for (ADMIN) [176.125.230.19]:40860: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 00:54:38 host2 sshd[2211360]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-29 00:54:15 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:59857: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-29 00:54:24 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:41532: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 00:56:03 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:43953: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-29 00:56:53 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:60794: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-29 00:57:04 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:41695: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-29 00:59:19 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:48256: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-29 01:08:49 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:51255: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.210
country_id: 6252001
description:
2025-11-29 01:08:51 dovecot_login authenticator failed for (ADMIN) [191.96.67.210]:41872: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 01:09:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9VMiyKxEKKQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 01:09:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<pNouyaxEXIcXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 01:10:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<eie7zKxE+uVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-29 01:12:19 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:47198: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-11-29 01:12:43 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:39426: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-29 01:19:59 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:46848: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-11-29 01:20:15 dovecot_login authenticator failed for ([49.124.152.172]) [49.124.152.172]:40698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov 29 01:21:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<I61S86xESdHN0h+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-29 01:23:51 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (eappics) [76.157.219.158]:33034: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.240.205.167
country_id: 6252001
description:
2025-11-29 01:23:59 dovecot_login authenticator failed for (ADMIN) [151.240.205.167]:38896: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-29 01:24:53 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:56309: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-29 01:25:20 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:44730: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:27:28 host2 sshd[2232865]: Disconnected from invalid user elsearch 160.187.141.218 port 37904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:27:48 host2 sshd[2233030]: Disconnected from invalid user init 103.252.118.164 port 9672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:30:30 host2 sshd[2234772]: Disconnected from invalid user administrator 103.252.118.164 port 41068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:31:47 host2 sshd[2235409]: Disconnected from invalid user saas 209.141.57.124 port 40114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-11-29 01:33:03 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:48324: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:32:58 host2 sshd[2235913]: Disconnected from invalid user devuser 103.252.118.164 port 5882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-29 01:33:19 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:52434: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:34:13 host2 sshd[2236509]: Disconnected from invalid user pivpn 103.252.118.164 port 3180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-29 01:35:37 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:55167: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:35:17 host2 sshd[2237330]: Disconnected from invalid user ftpuser 209.141.57.124 port 34956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-29 01:35:28 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:35805: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 29 01:36:48 host2 sshd[2238288]: Disconnected from invalid user mcserver 103.252.118.164 port 4790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:36:55 host2 sshd[2238367]: Disconnected from invalid user elemental 209.141.57.124 port 34094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:41:39 host2 sshd[2241519]: Disconnected from invalid user casaos 209.141.57.124 port 59752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Nov 29 01:43:10 host2 sshd[2242308]: Disconnected from invalid user zjw 209.141.57.124 port 58910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:45:40 host2 sshd[2244762]: Disconnected from invalid user bkp 160.187.141.218 port 53732 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:47:39 host2 sshd[2245761]: Disconnected from invalid user update 160.187.141.218 port 58082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.141.218
country_id: 1880251
description:
Nov 29 01:49:39 host2 sshd[2246808]: Disconnected from invalid user jenkins 160.187.141.218 port 34240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-29 01:52:25 dovecot_plain authenticator failed for (aillocks) [24.187.213.29]:32834: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.187
country_id: 1733045
description:
2025-11-29 01:54:11 dovecot_login authenticator failed for ([49.124.159.187]) [49.124.159.187]:36612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.82
country_id: 6252001
description:
2025-11-29 01:54:20 dovecot_login authenticator failed for ([70.174.168.82]) [70.174.168.82]:41900: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-29 01:57:43 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:33671: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-29 01:57:59 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:51072: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.83
country_id: 6252001
description:
2025-11-29 01:58:59 dovecot_login authenticator failed for (ADMIN) [212.32.49.83]:63136: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Nov 29 02:00:22 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.89, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ivOrf61EwszN0h9Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 29 02:05:32 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<uJokkq1ElLBChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:10:23 host2 sshd[2261487]: Disconnected from invalid user opc 101.47.51.246 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:10:44 host2 sshd[2261817]: Disconnected from invalid user ubuntu 148.227.3.232 port 49056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:13:51 host2 sshd[2263830]: Disconnected from invalid user info 45.78.207.230 port 49104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.20
country_id: 6252001
description:
2025-11-29 02:15:22 dovecot_login authenticator failed for (ADMIN) [212.32.49.20]:22387: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:18:31 host2 sshd[2266465]: Disconnected from invalid user ubuntu 101.47.51.246 port 50830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 02:23:14 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:15138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-29 02:22:43 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:32774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:24:16 host2 sshd[2269882]: Disconnected from invalid user vpn 45.78.207.230 port 37464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:25:12 host2 sshd[2270646]: Disconnected from invalid user info 148.227.3.232 port 51472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-29 02:25:31 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:36650: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-29 02:25:41 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:51286: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-29 02:26:49 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:47812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 02:26:54 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<nip23q1EgiBRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-29 02:27:01 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:44174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:29:23 host2 sshd[2273375]: Disconnected from invalid user ubuntu 45.78.207.230 port 52246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:29:57 host2 sshd[2273730]: Disconnected from invalid user ansadmin 148.227.3.232 port 39612 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.46
country_id: 6252001
description:
Nov 29 02:31:25 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.46, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iqu+7q1E3MuTuYQu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Nov 29 02:32:24 host2 sshd[2275603]: Disconnected from invalid user vpn 148.227.3.232 port 48460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.21
country_id: 174982
description:
2025-11-29 02:32:34 dovecot_login authenticator failed for (ADMIN) [185.253.160.21]:6601: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.230
country_id: 1880251
description:
Nov 29 02:39:35 host2 sshd[2280387]: Disconnected from invalid user mark 45.78.207.230 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Nov 29 02:41:38 host2 sshd[2282020]: Disconnected from invalid user admin123 101.47.51.246 port 60284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-11-29 02:46:03 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:50154: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-29 02:45:45 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:55138: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-29 02:45:50 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:50954: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.177.233.98
country_id: 6252001
description:
Nov 29 02:48:27 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=66.177.233.98, lip=66.85.158.91, TLS, session=<AgiAK65EmOtCseli>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 98.147.132.171
country_id: 6252001
description:
Nov 29 02:48:31 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=98.147.132.171, lip=66.85.158.91, TLS, session=<S+S7K65Exppik4Sr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.43
country_id: 660013
description:
2025-11-29 02:49:22 dovecot_login authenticator failed for (ADMIN) [188.126.89.43]:51402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 02:51:05 host2 sshd[2288258]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.233.203
country_id: 2921044
description:
Nov 29 02:51:28 host2 pure-ftpd[2288412]: (?@46.101.233.203) [INFO] New connection from 46.101.233.203


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.143.235
country_id: 2921044
description:
Nov 29 02:51:29 host2 pure-ftpd[2288416]: (?@165.227.143.235) [INFO] New connection from 165.227.143.235


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.34.38
country_id: 1831722
description:
Nov 29 02:57:00 host2 pure-ftpd[2292179]: (?@160.202.34.38) [INFO] New connection from 160.202.34.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-29 02:59:56 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:61950: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 03:07:13 host2 sshd[2298886]: Disconnected from invalid user admin 2.57.121.112 port 34883 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-29 03:08:40 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:37310: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-29 03:08:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:38968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.59
country_id: 2635167
description:
Nov 29 03:12:45 host2 pure-ftpd[2302158]: (?@185.247.137.59) [INFO] New connection from 185.247.137.59


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 29 03:15:40 host2 sshd[2304054]: Disconnected from invalid user debianuser 103.248.120.6 port 37030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 03:17:57 host2 sshd[2305334]: Disconnected from invalid user admin 2.57.121.112 port 17667 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 29 03:20:58 host2 sshd[2307231]: Disconnected from invalid user ubuntu 103.248.120.6 port 59420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 03:21:36 host2 sshd[2307547]: Disconnected from invalid user brycen 62.60.131.157 port 61907 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.235
country_id: 6252001
description:
2025-11-29 03:26:33 dovecot_login authenticator failed for (ADMIN) [102.129.252.235]:60696: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-29 03:27:53 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-29 03:28:08 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46162: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-11-29 03:31:38 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:60606: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-29 03:31:50 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:57900: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.144.173
country_id: 357994
description:
2025-11-29 03:32:01 dovecot_plain authenticator failed for (pecosimis) [41.239.144.173]:39074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 03:36:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51723: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.69
country_id: 2963597
description:
2025-11-29 03:39:49 dovecot_login authenticator failed for (ADMIN) [155.2.194.69]:36455: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-29 03:44:15 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:43582: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-29 03:44:30 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:59662: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 29 03:47:14 host2 sshd[2325344]: Disconnected from invalid user rstudio 164.90.225.61 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 03:49:41 host2 sshd[2327366]: Disconnected from invalid user gerrit 74.249.6.90 port 41026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 29 03:49:20 host2 sshd[2327214]: Disconnected from invalid user admin123 164.90.225.61 port 47196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 03:54:29 host2 sshd[2331734]: Disconnected from invalid user supermaint 74.249.6.90 port 46444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-11-29 03:56:07 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:57542: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-29 03:56:30 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:60108: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.111
country_id: 3996063
description:
2025-11-29 03:57:39 dovecot_login authenticator failed for (ADMIN) [77.81.142.111]:58544: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 03:59:27 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<NOt1Ka9EBogXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 29 04:05:52 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<26FeQK9EasSSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:06:59 host2 sshd[2344911]: Disconnected from invalid user admin123 74.249.6.90 port 56806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-11-29 04:10:57 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:46716: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:15:34 host2 sshd[2353879]: Disconnected from invalid user sopuser 74.249.6.90 port 44304 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 04:17:55 host2 sshd[2356332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.104
country_id: 3865483
description:
2025-11-29 04:18:08 dovecot_login authenticator failed for (ADMIN) [146.70.38.104]:1373: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 04:18:49 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13215: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 04:19:13 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:49220: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-11-29 04:19:35 dovecot_login authenticator failed for (76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:34746: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-11-29 04:19:40 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:46048: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-11-29 04:19:20 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:42690: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-29 04:22:56 dovecot_plain authenticator failed for (nucabocal) [65.20.174.63]:51615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.6.90
country_id: 6252001
description:
Nov 29 04:23:27 host2 sshd[2360865]: Disconnected from invalid user bob 74.249.6.90 port 55962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 04:28:49 host2 sshd[2367369]: Disconnected from invalid user admin 2.57.121.112 port 18255 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.208.44.62
country_id: 3469034
description:
[2025-11-29 04:28:50 +0530] info [whostmgrd] 179.208.44.62 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.178.174.195
country_id: 3469034
description:
[2025-11-29 04:28:50 +0530] info [cpaneld] 45.178.174.195 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:34:17 host2 sshd[2371302]: Disconnected from invalid user adam 205.185.126.121 port 43044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:36:35 host2 sshd[2372923]: Disconnected from invalid user tempuser 132.145.213.106 port 44150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.48
country_id: 953987
description:
2025-11-29 04:36:42 dovecot_login authenticator failed for (ADMIN) [154.47.30.48]:2468: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:36:44 host2 sshd[2373002]: Disconnected from invalid user test 205.185.126.121 port 55992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:37:32 host2 sshd[2373496]: Disconnected from invalid user postgres 156.236.75.64 port 38374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:37:58 host2 sshd[2373724]: Disconnected from invalid user ubuntu 205.185.126.121 port 54920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:39:10 host2 sshd[2374327]: Disconnected from invalid user testuser 205.185.126.121 port 53848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 04:39:26 host2 sshd[2374562]: Disconnected from invalid user admin 2.57.121.112 port 45532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:40:36 host2 sshd[2375403]: Disconnected from invalid user jacob 156.236.75.64 port 41366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Nov 29 04:41:28 host2 sshd[2375835]: Disconnected from invalid user debian 205.185.126.121 port 51708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:41:59 host2 sshd[2376117]: Disconnected from invalid user debianuser 152.32.189.21 port 53890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2025-11-29 04:42:43 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:43869: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-29 04:42:58 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:4341: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:43:15 host2 sshd[2376998]: Disconnected from invalid user deamon 190.129.122.120 port 39242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:43:27 host2 sshd[2377129]: Disconnected from invalid user radio 156.236.75.64 port 40790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:45:18 host2 sshd[2378670]: Disconnected from invalid user newuser 132.145.213.106 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:45:47 host2 sshd[2379474]: Disconnected from invalid user zmarin 152.32.189.21 port 59806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Nov 29 04:46:18 host2 sshd[2380081]: Disconnected from invalid user jacob 156.236.75.64 port 52682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 29 04:47:44 host2 sshd[2381037]: Disconnected from invalid user adam 132.145.213.106 port 49618 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:26 host2 sshd[2383526]: Disconnecting authenticating user root 45.44.153.69 port 53357: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:26 host2 sshd[2383526]: error: maximum authentication attempts exceeded for root from 45.44.153.69 port 53357 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:34 host2 sshd[2383634]: error: maximum authentication attempts exceeded for invalid user admin from 45.44.153.69 port 53868 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.44.153.69
country_id: 6251999
description:
Nov 29 04:50:36 host2 sshd[2383651]: Disconnecting invalid user admin 45.44.153.69 port 53988: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 29 04:51:43 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, TLS: Connection closed, session=<B5Z95K9EkAinXpI2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:52:20 host2 sshd[2384937]: Disconnected from invalid user fred 190.129.122.120 port 55458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.50
country_id: 732800
description:
2025-11-29 04:52:39 dovecot_login authenticator failed for (ADMIN) [94.156.14.50]:50916: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 29 04:53:15 host2 sshd[2385579]: Disconnected from invalid user intell 152.32.189.21 port 37582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.120
country_id: 3923057
description:
Nov 29 04:53:48 host2 sshd[2385896]: Disconnected from invalid user postgres 190.129.122.120 port 39488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-29 04:58:27 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:33352: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-29 04:59:08 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:35267: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.229.156
country_id: 6252001
description:
Nov 29 05:03:25 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.255.229.156, lip=66.85.158.92, session=<N4VMDrBEkNit/+Wc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.196.226
country_id: 6252001
description:
Nov 29 05:03:25 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=206.189.196.226, lip=66.85.158.92, session=<WBpVDrBERNrOvcTi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-29 05:05:07 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34990: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-29 05:05:25 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:54790: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-29 05:05:39 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:48256: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.172
country_id: 2623032
description:
2025-11-29 05:09:05 dovecot_login authenticator failed for (ADMIN) [188.126.94.172]:58689: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-29 05:10:29 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (sipsic) [174.59.253.88]:56612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-11-29 05:10:26 dovecot_plain authenticator failed for (bachemnos) [149.62.239.4]:49920: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.205.151.247
country_id: 6252001
description:
Nov 29 05:11:30 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=67.205.151.247, lip=66.85.158.92, session=<gnI0K7BEKrlDzZf3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-29 05:16:26 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:59404: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-29 05:16:37 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:40594: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.60.158
country_id: 6252001
description:
Nov 29 05:17:54 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.60.158, lip=66.85.158.91, session=<qOUhQrBExIwtITye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.239.4.152
country_id: 6252001
description:
Nov 29 05:17:54 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=23.239.4.152, lip=66.85.158.91, session=<m0EdQrBEsrQX7wSY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.109.86
country_id: 6252001
description:
Nov 29 05:21:03 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=137.184.109.86, lip=66.85.158.91, session=<S89jTbBEHImJuG1W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Nov 29 05:25:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<4b33XrBErPjHLZp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 05:27:19 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<DjWuY7BERExRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-29 05:27:55 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:34688: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-11-29 05:28:09 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:49667: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-29 05:31:00 dovecot_plain authenticator failed for (uncoldne) [84.238.92.245]:38045: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-29 05:36:49 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:50682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-11-29 05:39:48 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:35266: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-11-29 05:39:34 dovecot_login authenticator failed for ([190.223.36.108]) [190.223.36.108]:53948: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.164
country_id: 2623032
description:
2025-11-29 05:43:28 dovecot_login authenticator failed for (ADMIN) [188.126.94.164]:26481: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 05:48:37 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<NY/cr7BEDqsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-11-29 05:53:04 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:51261: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-11-29 05:53:46 dovecot_login authenticator failed for ([103.245.109.37]) [103.245.109.37]:36460: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.34
country_id: 2186224
description:
2025-11-29 06:02:04 dovecot_login authenticator failed for (ADMIN) [179.61.240.34]:16596: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.83
country_id: 1861060
description:
2025-11-29 06:20:14 dovecot_login authenticator failed for (ADMIN) [149.22.87.83]:7558: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.67
country_id: 6252001
description:
Nov 29 06:22:54 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AOiMKrFEFNbG6xhD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:24:50 host2 sshd[2450268]: Disconnected from invalid user osboxes 45.78.203.176 port 42566 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 06:28:51 host2 sshd[2452524]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-29 06:34:33 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:39290: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-29 06:35:04 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:37962: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-11-29 06:34:23 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:36360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:34:28 host2 sshd[2455984]: Disconnected from invalid user amssys 45.78.203.176 port 36550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-11-29 06:35:17 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:39826: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-11-29 06:35:42 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:36846: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 06:37:23 host2 sshd[2457926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.207
country_id: 6252001
description:
2025-11-29 06:37:34 dovecot_login authenticator failed for (ADMIN) [173.244.56.207]:18340: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-29 06:37:58 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:39652: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:40:04 host2 sshd[2459269]: Disconnected from invalid user dmdba 45.78.203.176 port 40470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-29 06:40:11 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:33689: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Nov 29 06:39:10 host2 sshd[2458884]: Disconnected from invalid user alex 101.47.48.255 port 56480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.255
country_id: 1880251
description:
Nov 29 06:42:46 host2 sshd[2461364]: Disconnected from invalid user user1 101.47.48.255 port 41346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-29 06:43:32 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:47880: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-29 06:43:46 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:48650: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 06:47:29 host2 sshd[2464924]: Disconnected from invalid user johana 62.60.131.157 port 46430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Nov 29 06:49:46 host2 sshd[2466372]: Disconnected from invalid user system 45.78.203.176 port 42508 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.38
country_id: 2635167
description:
Nov 29 06:51:08 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS, session=<RquPj7FEr+K594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.111
country_id: 2635167
description:
Nov 29 06:51:18 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.111, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cQ0jkLFEt+O594lv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.131
country_id: 2635167
description:
Nov 29 06:51:51 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.131, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SnIekrFEhZpX7LCD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Nov 29 06:52:24 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<MfgZlLFErcVX7LBy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.142
country_id: 2635167
description:
Nov 29 06:52:58 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.142, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<jDsVlrFEVYy594mO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.133
country_id: 2635167
description:
Nov 29 06:54:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.133, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AygKmrFERdVX7LCF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.119
country_id: 2635167
description:
Nov 29 06:53:31 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.119, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Z7kQmLFEq4u594l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.121
country_id: 2635167
description:
Nov 29 06:54:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.121, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5Z0HnLFEQdFX7LB5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Nov 29 06:55:44 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<P238n7FEY9C594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.129
country_id: 2635167
description:
Nov 29 06:55:11 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.129, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<6vwCnrFEidZX7LCB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-29 06:56:54 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:58550: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-29 06:57:05 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:42906: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov 29 06:56:17 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<J8r3obFE8blX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 06:59:47 host2 sshd[2472706]: Disconnected from invalid user johana 62.60.131.157 port 13115 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 08:15:55 host2 sshd[2479174]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-29 08:16:51 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:38356: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-29 08:17:27 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:50109: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-29 08:17:28 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:45231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.77
country_id: 2186224
description:
2025-11-29 08:17:51 dovecot_login authenticator failed for ([121.73.169.77]) [121.73.169.77]:45928: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-29 08:17:50 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:58280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:19:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3eMbyrJEMtSTuYRB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:19:26 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7ddTy7JEkv6TuYRB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.113.208.46
country_id: 6252001
description:
2025-11-29 08:21:06 dovecot_login authenticator failed for 46.208.113.136.bc.googleusercontent.com [136.113.208.46]:59432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-29 08:21:35 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:55132: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.26
country_id: 2963597
description:
2025-11-29 08:23:22 dovecot_login authenticator failed for (ADMIN) [155.2.194.26]:17777: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.65
country_id: 6252001
description:
Nov 29 08:24:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.65, lip=66.85.158.92, TLS, session=<1cNA3LJEavuTuYRB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 08:24:28 host2 sshd[2484267]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-29 08:26:32 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:57484: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-29 08:26:47 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:41340: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-29 08:37:02 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (sporesood) [98.204.134.124]:36488: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.87
country_id: 6252001
description:
Nov 29 08:37:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.87, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5i5gCrNEtsrN0h9X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-11-29 08:44:30 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:50182: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 08:53:40 host2 sshd[2503578]: Disconnected from invalid user jenkins 161.132.68.201 port 48642 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 29 08:58:39 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<qO+ZV7NEIQkt4/6Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 08:59:46 host2 sshd[2507235]: Disconnected from invalid user testuser 152.69.233.26 port 35444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:00:03 host2 sshd[2507483]: Disconnected from invalid user node 161.132.68.201 port 55766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:02:43 host2 sshd[2509015]: Disconnected from invalid user ventas01 161.132.68.201 port 39456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 09:04:00 host2 sshd[2509968]: Disconnected from invalid user zimbra 152.69.233.26 port 44958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Nov 29 09:05:19 host2 sshd[2510804]: Disconnected from invalid user test 161.132.68.201 port 51958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-29 09:06:52 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:43756: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-29 09:07:02 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45104: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Nov 29 09:14:44 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.117, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D4UWkbNEMdaTuYR1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.17
country_id: 2921044
description:
2025-11-29 09:15:30 dovecot_login authenticator failed for (ADMIN) [191.101.157.17]:48162: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-29 09:18:51 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:54320: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-29 09:19:01 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37060: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-11-29 09:21:02 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:51138: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-29 09:21:09 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:55002: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-29 09:21:20 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:49640: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:22:20 host2 sshd[2521037]: Disconnected from invalid user fiscal 34.69.0.72 port 54386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.69.233.26
country_id: 1835841
description:
Nov 29 09:22:33 host2 sshd[2521127]: Disconnected from invalid user node 152.69.233.26 port 45508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:29:38 host2 sshd[2525923]: Disconnected from invalid user marco 34.69.0.72 port 42428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-29 09:30:49 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:34447: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-29 09:31:06 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:33282: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:32:12 host2 sshd[2528182]: Disconnected from invalid user bot 34.69.0.72 port 54696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.94
country_id: 2635167
description:
2025-11-29 09:32:28 dovecot_login authenticator failed for (ADMIN) [158.173.24.94]:13457: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Nov 29 09:33:30 host2 sshd[2528992]: Disconnected from invalid user admin1234 34.69.0.72 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:42:35 host2 sshd[2535340]: Disconnected from invalid user a 118.26.36.195 port 39202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:46:03 host2 sshd[2538883]: Disconnected from invalid user rstudio 206.189.130.118 port 60256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:45:42 host2 sshd[2538570]: Disconnected from invalid user opc 118.26.36.195 port 55156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 09:45:56 host2 sshd[2538725]: Disconnected from invalid user testadmin 69.5.0.120 port 60820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.200.40
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.200.40 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-29 09:47:41 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:45662: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-11-29 09:47:56 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:58458: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:48:02 host2 sshd[2540030]: Disconnected from invalid user rstudio 118.26.36.195 port 40630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 09:48:07 host2 sshd[2540104]: Disconnected from invalid user devuser 69.5.0.120 port 59588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.28
country_id: 718075
description:
2025-11-29 09:48:13 dovecot_login authenticator failed for (ADMIN) [185.225.31.28]:15110: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 29 09:50:23 host2 sshd[2541552]: Disconnected from invalid user ts2 118.26.36.195 port 46558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-11-29 09:50:52 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:48736: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-29 09:51:26 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56722: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:52:26 host2 sshd[2542821]: Disconnected from invalid user maarch 206.189.130.118 port 59852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 29 09:53:41 host2 sshd[2543614]: Disconnected from invalid user sipv 206.189.130.118 port 54460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 09:56:16 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<+CGEJbREEvhRvaKO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 10:03:23 host2 sshd[2552107]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-11-29 10:05:11 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:39668: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-29 10:05:33 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:34458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.142
country_id: 3017382
description:
2025-11-29 10:06:30 dovecot_login authenticator failed for (ADMIN) [156.146.63.142]:44173: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 29 10:07:51 host2 sshd[2554756]: Disconnected from invalid user castle 36.95.194.54 port 43808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:09:03 host2 sshd[2555443]: Disconnected from invalid user kyt 51.178.141.222 port 47182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:10:12 host2 sshd[2556481]: Disconnected from invalid user usuario2 104.168.103.115 port 51582 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 10:12:05 host2 sshd[2557498]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 29 10:12:03 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<U5b3XbREppqSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:12:14 host2 sshd[2557552]: Disconnected from invalid user redmine 51.178.141.222 port 44428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:12:26 host2 sshd[2557654]: Disconnected from invalid user testuser 75.159.69.29 port 57688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 29 10:13:32 host2 sshd[2558252]: Disconnected from invalid user openbravo 36.95.194.54 port 34110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:13:52 host2 sshd[2558460]: Disconnected from invalid user gns3 104.168.103.115 port 38696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:16:04 host2 sshd[2559925]: Disconnected from invalid user super 104.168.103.115 port 55318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 29 10:17:21 host2 sshd[2560587]: Disconnected from invalid user cc 104.168.103.115 port 34684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:17:55 host2 sshd[2560826]: Disconnected from invalid user userroot 51.178.141.222 port 54844 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:17:38 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AbsRcrREQK8DhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:17:39 host2 sshd[2560718]: Disconnected from invalid user openbravo 75.159.69.29 port 39084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Nov 29 10:18:54 host2 sshd[2561389]: Disconnected from invalid user sipv 69.5.0.120 port 42438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 29 10:18:56 host2 sshd[2561429]: Disconnected from invalid user kapsch 75.159.69.29 port 41486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:18:58 host2 sshd[2561458]: Disconnected from invalid user zhangsan 51.178.141.222 port 56904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.217
country_id: 6252001
description:
2025-11-29 10:20:23 dovecot_login authenticator failed for (ADMIN) [181.214.166.217]:60638: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 29 10:21:13 host2 sshd[2563278]: Disconnected from invalid user autrede 51.178.141.222 port 32814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:21:33 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<evUJgLREAIUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.244
country_id: 3017382
description:
Nov 29 10:23:57 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.244, lip=66.85.158.91, session=<D6iqiLRExbZb51n0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:23:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Vy6viLRE2OkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.140
country_id: 3017382
description:
Nov 29 10:23:34 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.140, lip=66.85.158.91, session=<mfxJh7REr5lb51mM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.243
country_id: 3017382
description:
Nov 29 10:23:45 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.243, lip=66.85.158.91, session=<nxfnh7RE+YNb51nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:25:38 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7D2ijrREspgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:27:09 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<nlsQlLRENOkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 29 10:27:34 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<34mMlbREmskDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.64
country_id: 3017382
description:
2025-11-29 10:34:26 dovecot_login authenticator failed for (ADMIN) [191.101.31.64]:47711: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:44:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<sCfK0LREh88jy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:45:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<GMwu1LRE7PAjy9Iz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.2
country_id: 2635167
description:
Nov 29 10:44:57 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.2, lip=66.85.158.92, TLS, session=<vFW+07RE1ZVX7LAC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:45:29 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<drKh1bRE8Pkjy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:50:51 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS, session=<gc/d6LREku8jy9Iz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.51
country_id: 2635167
description:
Nov 29 10:51:24 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.51, lip=66.85.158.91, TLS, session=<mQPQ6rREgugjy9Iz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 10:53:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52657: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.38
country_id: 6252001
description:
2025-11-29 10:53:37 dovecot_login authenticator failed for (ADMIN) [158.173.25.38]:8757: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-29 10:56:07 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:53636: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-29 10:56:17 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:35499: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 11:00:31 host2 sshd[2587620]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:07:19 host2 sshd[2592162]: Disconnected from invalid user media 103.179.27.94 port 35176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:08:54 host2 sshd[2593141]: Disconnected from invalid user root1 103.179.27.94 port 36352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:09:20 host2 sshd[2593419]: Disconnected from invalid user local 45.78.228.30 port 40202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.57
country_id: 6251999
description:
2025-11-29 11:10:14 dovecot_login authenticator failed for (ADMIN) [212.56.52.57]:44962: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:10:30 host2 sshd[2594497]: Disconnected from invalid user vyos 103.179.27.94 port 49428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-11-29 11:12:10 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:44876: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-29 11:12:00 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:54377: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:13:53 host2 sshd[2596836]: Disconnected from invalid user terraria 202.8.127.134 port 46608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Nov 29 11:15:00 host2 sshd[2597411]: Disconnected from invalid user devuser 103.179.27.94 port 53058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-29 11:15:28 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:37360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-29 11:15:35 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:38254: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:16:43 host2 sshd[2598661]: Disconnected from invalid user ventas01 45.78.228.30 port 42068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:16:36 host2 sshd[2598611]: Disconnected from invalid user khan 202.8.127.134 port 44170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-29 11:17:25 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:54873: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.60.131.153
country_id: 130758
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.60.131.153 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-29 11:17:14 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:52242: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:19:08 host2 sshd[2599869]: Disconnected from invalid user ubuntu 45.78.228.30 port 51596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Nov 29 11:20:40 host2 sshd[2601113]: Disconnected from invalid user rstudio 202.8.127.134 port 40520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.7.154
country_id: 6252001
description:
2025-11-29 11:20:10 dovecot_plain authenticator failed for ([10.25.18.229]) [84.239.7.154]:51584: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.30
country_id: 1880251
description:
Nov 29 11:28:41 host2 sshd[2605601]: Disconnected from invalid user sammy 45.78.228.30 port 49898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 29 11:29:10 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<8YXgcbVE6OcjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.252
country_id: 3469034
description:
2025-11-29 11:30:26 dovecot_login authenticator failed for (ADMIN) [188.241.177.252]:58084: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-11-29 11:31:51 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:35699: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-29 11:32:06 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:59750: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 29 11:32:06 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.234, lip=66.85.158.92, session=<lXhVfLVEbPSTuYTq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 11:33:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<c+MRgLVENooXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:44:41 host2 sshd[2615580]: Disconnected from invalid user deploy 150.5.129.10 port 45508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.87
country_id: 2635167
description:
2025-11-29 11:46:18 dovecot_login authenticator failed for (ADMIN) [158.173.24.87]:18804: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:47:33 host2 sshd[2617754]: Disconnected from invalid user ts 150.5.129.10 port 60158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:48:54 host2 sshd[2618449]: Disconnected from invalid user ftp1 150.5.129.10 port 59066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:50:10 host2 sshd[2619406]: Disconnected from invalid user peter 150.5.129.10 port 57968 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 11:51:25 host2 sshd[2620121]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-29 11:51:28 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:50486: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 29 11:51:31 host2 sshd[2620157]: Disconnected from invalid user intell 150.5.129.10 port 56924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-29 11:51:14 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:36206: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-29 11:52:14 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:59941: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:52:38 host2 sshd[2620721]: Disconnected from invalid user ansible 188.166.232.44 port 45268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 11:52:45 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<LEQSxrVELxJRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:53:41 host2 sshd[2621254]: Disconnected from invalid user manager 143.110.186.36 port 54632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:55:03 host2 sshd[2622730]: Disconnected from invalid user toto 143.110.186.36 port 58768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:56:25 host2 sshd[2623539]: Disconnected from invalid user rahul 143.110.186.36 port 60790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Nov 29 11:57:46 host2 sshd[2624268]: Disconnected from invalid user marvin 143.110.186.36 port 55452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:57:51 host2 sshd[2624314]: Disconnected from invalid user liyang 188.166.232.44 port 46402 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 12:00:00 host2 sshd[2625542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 11:59:08 host2 sshd[2624966]: Disconnected from invalid user manager 188.166.232.44 port 45240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov 29 12:00:26 host2 sshd[2626008]: Disconnected from invalid user copia 188.166.232.44 port 44080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-29 12:00:49 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:59172: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-29 12:01:24 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:38392: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.24
country_id: 3194884
description:
2025-11-29 12:05:42 dovecot_login authenticator failed for (ADMIN) [176.125.229.24]:24577: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-29 12:06:00 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:57408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-29 12:06:11 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:48142: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:06:48 host2 sshd[2629727]: Disconnected from invalid user user1 45.78.230.104 port 35830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.226.72
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.226.72 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:09:06 host2 sshd[2630908]: Disconnected from invalid user student 45.78.230.104 port 43402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-29 12:09:34 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:32946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-29 12:09:46 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:45355: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-11-29 12:09:55 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4167: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.149
country_id: 2661886
description:
2025-11-29 12:09:13 dovecot_login authenticator failed for 95.209.141.149.bredband.tre.se [95.209.141.149]:35402: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.238
country_id: 6252001
description:
Nov 29 12:11:07 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.238, lip=66.85.158.92, TLS, session=<RHXoB7ZEnPDN0h/u>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.104
country_id: 1880251
description:
Nov 29 12:11:25 host2 sshd[2632529]: Disconnected from invalid user rich 45.78.230.104 port 43976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.185.102.224
country_id: 2921044
description:
Nov 29 12:12:14 host2 sshd[2632912]: Disconnected from invalid user builder 18.185.102.224 port 39006 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.42
country_id: 1819730
description:
Nov 29 12:16:11 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.42, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Mg4DGrZE8tstjpoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-29 12:18:29 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:32964: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-29 12:19:06 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:40166: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:20:19 host2 sshd[2637756]: Disconnected from invalid user sammy 103.249.84.18 port 45098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:23:43 host2 sshd[2639525]: Disconnected from invalid user student 103.249.84.18 port 47828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-29 12:25:37 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:58459: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:25:11 host2 sshd[2640519]: Disconnected from invalid user sammy 103.249.84.18 port 35384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.131
country_id: 1210997
description:
2025-11-29 12:26:47 dovecot_login authenticator failed for (ADMIN) [64.64.112.131]:60113: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 29 12:27:54 host2 sshd[2642000]: Disconnected from invalid user ubuntu 103.249.84.18 port 52088 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 171.225.223.108
country_id: 1562822
description:
Denial of Service (DoS) attack was discovered from 171.225.223.108: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.136
country_id: 2921044
description:
2025-11-29 12:42:38 dovecot_login authenticator failed for (ADMIN) [191.101.157.136]:41708: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-29 12:48:48 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:49714: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-29 12:49:09 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:55496: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-11-29 12:53:46 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:50642: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-29 12:53:33 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:40508: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Nov 29 12:54:16 host2 pure-ftpd[2658116]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-29 12:55:41 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:46631: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.23
country_id: 1227603
description:
2025-11-29 12:59:11 dovecot_login authenticator failed for (ADMIN) [95.181.239.23]:33692: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 13:00:39 host2 sshd[2662210]: Disconnected from invalid user marcella 62.60.131.157 port 14005 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-29 13:01:33 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13781: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-29 13:01:54 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:37576: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.195.143
country_id: 6252001
description:
Nov 29 13:07:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.195.143, lip=66.85.158.92, session=<JqS30rZEguKs6cOP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:13:42 host2 sshd[2670547]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-11-29 13:16:34 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:45269: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-11-29 13:16:47 dovecot_login authenticator failed for ([128.185.217.150]) [125.19.157.158]:60972: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.18
country_id: 2589581
description:
2025-11-29 13:16:09 dovecot_login authenticator failed for (ADMIN) [176.125.228.18]:11309: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.30
country_id: 6252001
description:
Nov 29 13:17:09 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.30, lip=66.85.158.91, TLS, session=<yZ4O9LZEsvqTuYQe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-29 13:27:21 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:57432: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-29 13:28:52 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:42838: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-29 13:31:21 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:53959: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.7
country_id: 2993457
description:
2025-11-29 13:35:25 dovecot_login authenticator failed for (ADMIN) [95.181.233.7]:15350: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 13:38:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<XA61PrdEGLMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 13:38:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4Y/VP7dETNIXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:39:28 host2 sshd[2685673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-29 13:44:42 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:59819: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 13:44:48 host2 sshd[2688528]: Disconnected from invalid user  2.57.121.112 port 61612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-29 13:45:04 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:52632: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 13:48:03 host2 sshd[2691093]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.239.208.223
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.239.208.223 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.19.37
country_id: 2921044
description:
2025-11-29 13:52:16 dovecot_login authenticator failed for (ADMIN) [138.199.19.37]:5764: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-29 13:54:19 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:43874: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-29 13:54:33 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:9612: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-29 13:56:46 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:50484: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-29 13:57:05 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:56992: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-29 13:57:30 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:40472: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-29 13:57:47 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:33263: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-29 13:57:46 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:59536: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.91
country_id: 6252001
description:
2025-11-29 13:58:04 dovecot_login authenticator failed for ([70.174.168.91]) [70.174.168.91]:37736: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 14:01:01 host2 sshd[2698689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-29 14:01:47 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:33469: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:04:16 host2 sshd[2700997]: Disconnected from invalid user gg 179.32.207.251 port 58156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-29 14:04:51 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:45532: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 14:05:10 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53613: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 14:06:06 host2 sshd[2702014]: Disconnected from invalid user  2.57.121.112 port 61299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 29 14:06:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<oN0kpbdEbOZ283VD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Nov 29 14:07:25 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.55, lip=66.85.158.91, TLS, session=<zknRp7dE/PPN0h83>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.15
country_id: 3175395
description:
2025-11-29 14:07:31 dovecot_login authenticator failed for (ADMIN) [156.146.41.15]:50886: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:08:42 host2 sshd[2703466]: Disconnected from invalid user old 179.32.207.251 port 38202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-29 14:09:55 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:55726: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:09:57 host2 sshd[2704103]: Disconnected from invalid user sipv 179.32.207.251 port 40468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-29 14:10:10 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:39218: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.202.145
country_id: 6252001
description:
Nov 29 14:10:47 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.118.202.145, lip=66.85.158.92, session=<0TnZs7dECuMUdsqR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 29 14:11:15 host2 sshd[2704942]: Disconnected from invalid user testuser 179.32.207.251 port 42722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 14:12:06 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Y2p3uLdElmlRvaKO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.83.162.167
country_id: 1168579
description:
Nov 29 14:20:23 host2 sshd[2709951]: Disconnected from invalid user kafka 202.83.162.167 port 36264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:20:58 host2 sshd[2710304]: Disconnected from invalid user weblogic 104.168.56.59 port 36972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:23:10 host2 sshd[2711836]: Disconnected from invalid user debianuser 104.168.56.59 port 33606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.14
country_id: 174982
description:
2025-11-29 14:25:02 dovecot_login authenticator failed for (ADMIN) [185.253.160.14]:31158: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:24:15 host2 sshd[2712864]: Disconnected from invalid user jenkins 104.168.56.59 port 44556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 14:25:17 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lGWV57dEqKoXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:25:24 host2 sshd[2714066]: Disconnected from invalid user elastic 104.168.56.59 port 50064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 29 14:26:30 host2 sshd[2714822]: Disconnected from invalid user zhangsan 104.168.56.59 port 45388 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.157
country_id: 6252001
description:
Nov 29 14:27:21 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.104.157, lip=66.85.158.92, session=<zBwb77dE0JWsymid>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.90
country_id: 6252001
description:
Nov 29 14:28:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.90, lip=66.85.158.91, session=<UFsc8rdEzowofK1a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 14:29:27 host2 sshd[2716974]: Disconnected from invalid user tristan 62.60.131.157 port 26695 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.72
country_id: 6252001
description:
Nov 29 14:31:18 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.15.225.72, lip=66.85.158.91, session=<hkk+/bdEPL4UD+FI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.236
country_id: 1733045
description:
2025-11-29 14:32:31 dovecot_login authenticator failed for ([183.171.53.236]) [183.171.53.236]:51652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-29 14:33:00 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:40430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-29 14:35:43 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:52848: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-29 14:35:56 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:38059: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.155
country_id: 3077311
description:
2025-11-29 14:39:08 dovecot_login authenticator failed for (ADMIN) [212.102.39.155]:12315: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 14:39:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54455: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.118
country_id: 6252001
description:
Nov 29 14:42:09 host2 pure-ftpd[2725449]: (?@147.185.132.118) [INFO] New connection from 147.185.132.118


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:51:03 host2 sshd[2731579]: Disconnected from invalid user user 101.36.116.29 port 42134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:51:32 host2 sshd[2731906]: Disconnected from invalid user ftptest 85.133.253.204 port 54746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.203.52
country_id: 6252001
description:
Nov 29 14:51:45 host2 sshd[2732103]: Disconnected from invalid user ivan 167.172.203.52 port 38970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 14:51:18 host2 sshd[2731781]: Disconnected from invalid user test 209.141.53.124 port 40020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:52:23 host2 sshd[2732591]: Disconnected from invalid user admin1234 128.199.157.145 port 39216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-29 14:54:43 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:57508: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.203.52
country_id: 6252001
description:
Nov 29 14:54:45 host2 sshd[2734521]: Disconnected from invalid user free 167.172.203.52 port 33024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:54:47 host2 sshd[2734525]: Disconnected from invalid user bitrix 85.133.253.204 port 42892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:54:59 host2 sshd[2734625]: Disconnected from invalid user zmarin 101.36.116.29 port 52320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-29 14:55:02 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:55224: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:56:02 host2 sshd[2735338]: Disconnected from invalid user ts3 85.133.253.204 port 36592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:55:37 host2 sshd[2735159]: Disconnected from invalid user ts3 128.199.157.145 port 57024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 14:55:40 host2 sshd[2735171]: Disconnected from invalid user john 209.141.53.124 port 40332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:57:19 host2 sshd[2736123]: Disconnected from invalid user zimbra 85.133.253.204 port 60050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.19
country_id: 6251999
description:
2025-11-29 14:57:29 dovecot_login authenticator failed for (ADMIN) [212.56.52.19]:50402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 29 14:58:35 host2 sshd[2736937]: Disconnected from invalid user grid 85.133.253.204 port 42316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 29 14:59:29 host2 sshd[2737478]: Disconnected from invalid user kali 128.199.157.145 port 51774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 14:59:59 host2 sshd[2737741]: Disconnected from invalid user temp 101.36.116.29 port 56880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 29 15:01:04 host2 sshd[2738584]: Disconnected from invalid user qiyuesuo 209.141.53.124 port 36130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 29 15:01:07 host2 sshd[2738600]: Disconnected from invalid user admin123 101.36.116.29 port 35936 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 15:03:07 host2 sshd[2740011]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Nov 29 15:04:49 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.91, session=<k64bdbhEnPnG6xjU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-29 15:05:48 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:46463: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-29 15:05:32 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:46285: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 15:06:21 host2 sshd[2742089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.167
country_id: 6252001
description:
2025-11-29 15:13:48 dovecot_login authenticator failed for (ADMIN) [102.129.234.167]:35797: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.97.235.93
country_id: 3625428
description:
Nov 29 15:15:52 host2 sshd[2748942]: Disconnected from invalid user liyang 190.97.235.93 port 57836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.97.235.93
country_id: 3625428
description:
Nov 29 15:17:15 host2 sshd[2749880]: Disconnected from invalid user ubuntu 190.97.235.93 port 56820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.97.235.93
country_id: 3625428
description:
Nov 29 15:18:34 host2 sshd[2750784]: Disconnected from invalid user userm 190.97.235.93 port 36368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.97.235.93
country_id: 3625428
description:
Nov 29 15:19:50 host2 sshd[2751480]: Disconnected from invalid user proradis 190.97.235.93 port 38820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.241.154.146
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.241.154.146 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-11-29 15:25:13 dovecot_login authenticator failed for ([127.0.0.1]) [84.213.187.240]:45839: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2025-11-29 15:25:26 dovecot_login authenticator failed for ([127.0.0.1]) [177.236.146.58]:42805: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.177.206
country_id: 6252001
description:
Nov 29 15:27:05 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.67.177.206, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<w0G6xLhEAtUoQ7HO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 15:27:18 host2 sshd[2756040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-29 15:28:23 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:55924: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 15:29:14 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<+ahQzLhEkVRRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.74.80
country_id: 6252001
description:
Nov 29 15:32:30 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.74.80, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K2IS2LhENoEUDkpQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.121
country_id: 6252001
description:
Nov 29 15:34:46 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.121, lip=66.85.158.92, TLS: Connection closed, session=<9JY54LhEen7HLZp5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 15:35:53 host2 sshd[2760871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 29 15:42:14 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<ekXt+rhEqMuLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 15:45:38 host2 sshd[2767063]: Disconnected from invalid user abram 62.60.131.157 port 12877 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-11-29 15:48:17 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:43970: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-29 15:48:31 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:56781: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.218
country_id: 2510769
description:
2025-11-29 15:49:19 dovecot_login authenticator failed for (ADMIN) [212.102.49.218]:9920: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.251
country_id: 2635167
description:
Nov 29 15:50:32 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.251, lip=66.85.158.91, TLS, session=<AqaeGLlEx5RX7LD7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-29 15:52:21 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:53604: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.120.13
country_id: 1605651
description:
Nov 29 15:52:35 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.120.13, lip=66.85.158.92, TLS, session=<tnDuH7lECuelmngN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.120.13
country_id: 1605651
description:
Nov 29 15:52:34 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.120.13, lip=66.85.158.92, session=<L0zcH7lEpuWlmngN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-11-29 16:01:29 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:59453: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 29 16:04:19 host2 sshd[2780669]: Disconnected from invalid user manager 146.190.154.85 port 37806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 29 16:04:57 host2 sshd[2781046]: Disconnected from invalid user bitwarden 107.175.54.2 port 57164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
country_id: 174982
description:
2025-11-29 16:06:25 dovecot_login authenticator failed for ([212.73.75.82]) [212.73.75.82]:33289: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 29 16:07:16 host2 sshd[2782323]: Disconnected from invalid user kingbase 107.175.54.2 port 41394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-29 16:06:33 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:46375: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 29 16:08:33 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<p94KWblE2P8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.157
country_id: 3041565
description:
2025-11-29 16:08:33 dovecot_login authenticator failed for (ADMIN) [173.239.217.157]:28159: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 29 16:08:32 host2 sshd[2782936]: Disconnected from invalid user admin 107.175.54.2 port 43040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 29 16:09:28 host2 sshd[2783469]: Disconnected from invalid user intell 103.243.27.122 port 55662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 29 16:10:24 host2 sshd[2784240]: Disconnected from invalid user shree 146.190.154.85 port 40998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 29 16:10:45 host2 sshd[2784400]: Disconnected from invalid user bitwarden 103.243.27.122 port 57570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 29 16:10:45 host2 sshd[2784411]: Disconnected from invalid user temp 107.175.54.2 port 46332 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 29 16:11:27 host2 sshd[2784787]: Disconnected from invalid user admin 146.190.154.85 port 41936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 29 16:11:38 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<kszsY7lEGOGSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.215
country_id: 1269750
description:
2025-11-29 16:12:55 dovecot_login authenticator failed for (nsg-corporate-215.230.187.122.airtel.in) [122.187.230.215]:41091: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 29 16:13:04 host2 sshd[2785846]: Disconnected from invalid user user1 107.175.54.2 port 49628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-11-29 16:13:27 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:38768: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:13:51 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rLz0a7lEvOYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:14:36 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HyCsbrlEVJoDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 29 16:14:57 host2 sshd[2786621]: Disconnected from invalid user production 103.243.27.122 port 35040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:15:55 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gXNec7lEjJ4DlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 29 16:16:18 host2 sshd[2787648]: Disconnected from invalid user pivpn 103.243.27.122 port 36938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:17:40 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<s/iieblEdJYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:20:38 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sm02hLlESKcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 29 16:21:38 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c6XKh7lEdogDlTsa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.47
country_id: 2635167
description:
Nov 29 16:22:05 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.47, lip=66.85.158.91, TLS, session=<z9dliblEdbVX7LAv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.237
country_id: 2635167
description:
Nov 29 16:22:05 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.237, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GytyiblEmdi594nt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.164
country_id: 2635167
description:
2025-11-29 16:23:08 dovecot_login authenticator failed for (ADMIN) [98.159.234.164]:22616: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.233
country_id: 2635167
description:
Nov 29 16:23:12 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I+ZojblELai594np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-29 16:23:23 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:32840: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.246
country_id: 2635167
description:
Nov 29 16:22:39 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.246, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HYpti7lEP71X7LD2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-29 16:24:00 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:55720: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.244
country_id: 2635167
description:
Nov 29 16:24:18 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.244, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<rpRfkblEJ7e594n0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-11-29 16:23:42 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:42540: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.252
country_id: 2635167
description:
Nov 29 16:23:45 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.252, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zDpkj7lE+6S594n8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 16:25:25 host2 sshd[2792576]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.247
country_id: 2635167
description:
Nov 29 16:24:51 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.247, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<n/9Yk7lEIddX7LD3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.219
country_id: 2635167
description:
Nov 29 16:25:25 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.219, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Pz1WlblEEZNX7LDb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.235
country_id: 2635167
description:
Nov 29 16:25:58 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.235, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<FZ5Rl7lETYZX7LDr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.227
country_id: 2635167
description:
Nov 29 16:27:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.227, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<5XRGm7lE29S594nj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Nov 29 16:26:31 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<WA1LmblEt61X7LD7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.52.249.178
country_id: 6252001
description:
Nov 29 16:28:37 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=13.52.249.178, lip=66.85.158.92, TLS: Connection closed, session=<qOTGoLlEPLwNNPmy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-29 16:32:14 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:59058: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 29 16:32:23 host2 sshd[2797182]: Disconnected from invalid user huawei 122.53.133.167 port 47538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Nov 29 16:34:03 host2 sshd[2798202]: Disconnected from invalid user super 107.155.55.174 port 42356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Nov 29 16:33:59 host2 sshd[2798123]: Disconnected from invalid user root1 152.32.203.205 port 56836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Nov 29 16:35:23 host2 sshd[2799154]: Disconnected from invalid user developer 107.155.55.174 port 40986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 29 16:35:25 host2 sshd[2799181]: Disconnected from invalid user hello 205.185.127.60 port 39844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-29 16:36:29 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:35602: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-11-29 16:36:10 dovecot_login authenticator failed for (nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:54230: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Nov 29 16:36:14 host2 sshd[2799771]: Disconnected from invalid user rstudio 40.74.115.25 port 53730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Nov 29 16:38:07 host2 sshd[2800777]: Disconnected from invalid user user1 152.32.203.205 port 51476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Nov 29 16:37:55 host2 sshd[2800622]: Disconnected from invalid user superadmin 107.155.55.174 port 38242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Nov 29 16:39:10 host2 sshd[2801324]: Disconnected from invalid user usuario2 107.155.55.174 port 36874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Nov 29 16:39:38 host2 sshd[2801692]: Disconnected from invalid user nominatim 152.32.203.205 port 49700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 29 16:39:44 host2 sshd[2801728]: Disconnected from invalid user smart 122.53.133.167 port 39434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 29 16:40:09 host2 sshd[2802130]: Disconnected from invalid user fan 205.185.127.60 port 38076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Nov 29 16:40:41 host2 sshd[2802391]: Disconnected from invalid user grid 40.74.115.25 port 51236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Nov 29 16:40:47 host2 sshd[2802426]: Disconnected from invalid user usuario2 202.184.153.250 port 39422 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Nov 29 16:40:51 host2 sshd[2802511]: Disconnected from invalid user exx 152.32.203.205 port 47908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 29 16:40:55 host2 sshd[2802528]: Disconnected from invalid user fred 38.47.92.86 port 43504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.47
country_id: 798549
description:
2025-11-29 16:41:09 dovecot_login authenticator failed for (ADMIN) [143.244.52.47]:20755: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 29 16:41:28 host2 sshd[2802938]: Disconnected from invalid user odin 122.53.133.167 port 41576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Nov 29 16:42:04 host2 sshd[2803383]: Disconnected from invalid user tibero 152.32.203.205 port 46116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Nov 29 16:42:08 host2 sshd[2803421]: Disconnected from invalid user superadmin 40.74.115.25 port 33176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 29 16:42:14 host2 sshd[2803504]: Disconnected from invalid user user01 38.47.92.86 port 39846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 29 16:41:32 host2 sshd[2803022]: Disconnected from invalid user mika 205.185.127.60 port 39830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Nov 29 16:41:38 host2 sshd[2803072]: Disconnected from invalid user odin 107.155.55.174 port 34126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.88.132.37
country_id: 6252001
description:
Nov 29 16:41:49 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=35.88.132.37, lip=66.85.158.91, TLS: Connection closed, session=<ye0C0LlEkJUjWIQl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 29 16:42:45 host2 sshd[2804049]: Disconnected from invalid user rahul 205.185.127.60 port 41580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Nov 29 16:43:35 host2 sshd[2804716]: Disconnected from invalid user gns3 40.74.115.25 port 44404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 29 16:44:41 host2 sshd[2805291]: Disconnected from invalid user debian 38.47.92.86 port 41268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Nov 29 16:45:12 host2 sshd[2805867]: Disconnected from invalid user huawei 202.184.153.250 port 39166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-11-29 16:44:41 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:57466: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-29 16:47:00 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:35496: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 29 16:47:18 host2 sshd[2807488]: Disconnected from invalid user adam 38.47.92.86 port 48358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 16:47:36 host2 sshd[2807652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.123.253
country_id: 2921044
description:
Nov 29 16:48:00 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=157.230.123.253, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mbAd5rlEQpad5nv9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-29 16:52:17 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:36400: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-29 16:52:43 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:56374: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-29 16:59:09 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:43487: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.59
country_id: 1668284
description:
2025-11-29 16:59:43 dovecot_login authenticator failed for (ADMIN) [173.244.49.59]:59810: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-29 17:04:30 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:37573: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 29 17:10:18 host2 sshd[2824032]: Disconnected from invalid user developer 202.165.15.132 port 45719 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-29 17:11:51 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3546: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.85.186.172
country_id: 6252001
description:
Nov 29 17:12:59 host2 sshd[2825318]: Disconnected from invalid user sipv 67.85.186.172 port 44376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-29 17:13:52 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:43946: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-29 17:14:14 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:49618: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-11-29 17:14:29 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:51800: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-29 17:14:18 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:56686: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 17:15:22 host2 sshd[2827020]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 29 17:15:32 host2 sshd[2827107]: Disconnected from invalid user khan 202.165.15.132 port 35578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 29 17:16:50 host2 sshd[2827732]: Disconnected from invalid user supermaint 202.165.15.132 port 10466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.85.186.172
country_id: 6252001
description:
Nov 29 17:17:08 host2 sshd[2827903]: Disconnected from invalid user g 67.85.186.172 port 47980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 29 17:18:06 host2 sshd[2828347]: Disconnected from invalid user rstudio 202.165.15.132 port 40323 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 29 17:19:18 host2 sshd[2828898]: Disconnected from invalid user test 202.165.15.132 port 48798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.85.186.172
country_id: 6252001
description:
Nov 29 17:19:19 host2 sshd[2828907]: Disconnected from invalid user developer 67.85.186.172 port 43708 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.161.48
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 154.213.161.48 - isuru "GET /login/?login_only=1&user=isuru&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user isuru (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.54.217
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.54.217 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.164.194
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 154.213.164.194 - euroent8 "GET /login/?login_only=1&user=euroent8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.15.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.15.194 - euroent3 "GET /login/?login_only=1&user=euroent3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.175.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.50.175.31 - euroent4 "GET /login/?login_only=1&user=euroent4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.39.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.39.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.5.188
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.5.188 - euroentert "GET /login/?login_only=1&user=euroentert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.174.85
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.50.174.85 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.45.164
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.45.164 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.53.144
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.53.144 - euroen10 "GET /login/?login_only=1&user=euroen10&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen10 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.32.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.32.37 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.45.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.207.45.131 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.85.186.172
country_id: 6252001
description:
Nov 29 17:20:27 host2 sshd[2829779]: Disconnected from invalid user marvin 67.85.186.172 port 43038 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.28.160
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.28.160 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.51.108
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.51.108 - euroent7 "GET /login/?login_only=1&user=euroent7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.30.0
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.30.0 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.23.19
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.23.19 - euroenterta "GET /login/?login_only=1&user=euroenterta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenterta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.29.40
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.29.40 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.31.187
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.31.187 - euroen11 "GET /login/?login_only=1&user=euroen11&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen11 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.249.129
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.26.249.129 - euroentertainm "GET /login/?login_only=1&user=euroentertainm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.234.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.26.234.104 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.1.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.1.119 - euroent6 "GET /login/?login_only=1&user=euroent6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent6 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.155
country_id: 1210997
description:
2025-11-29 17:20:52 dovecot_login authenticator failed for (ADMIN) [64.64.112.155]:49882: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.251.153
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.26.251.153 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.34.120
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.207.34.120 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.39.245
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.3.39.245 - euroent5 "GET /login/?login_only=1&user=euroent5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.164.161
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 154.213.164.161 - euroentertain "GET /login/?login_only=1&user=euroentertain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.164.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.50.164.215 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.232.247
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.26.232.247 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.85.186.172
country_id: 6252001
description:
Nov 29 17:21:31 host2 sshd[2830406]: Disconnected from invalid user azureuser 67.85.186.172 port 56160 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 17:23:59 host2 sshd[2831558]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 17:26:52 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<uDfzcLpESM4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-29 17:34:59 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:58073: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-29 17:35:16 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:59200: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.20
country_id: 1227603
description:
2025-11-29 17:36:19 dovecot_login authenticator failed for (ADMIN) [95.181.239.20]:43840: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-29 17:38:23 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:50649: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-11-29 17:38:46 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:33490: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.184.248
country_id: 2921044
description:
Nov 29 17:40:39 host2 pure-ftpd[2841471]: (?@46.101.184.248) [INFO] New connection from 46.101.184.248


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 46.101.184.248
country_id: 2921044
description:
Nov 29 17:40:42 host2 pure-ftpd[2841516]: (?@46.101.184.248) [INFO] New connection from 46.101.184.248


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 29 17:43:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, TLS: Connection closed, session=<XFN2q7pEmMNChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-29 17:44:10 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:56959: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-29 17:44:58 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:33258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.62
country_id: 1269750
description:
2025-11-29 17:51:05 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:58464: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-11-29 17:52:30 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:55742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-29 17:52:43 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:38559: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-29 17:52:16 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:50298: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-29 17:56:49 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:54700: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-29 17:57:07 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:51050: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.250
country_id: 3469034
description:
2025-11-29 17:57:38 dovecot_login authenticator failed for (ADMIN) [188.241.177.250]:40601: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:08:26 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<iHO9BbtEtNADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-29 18:09:13 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:43728: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Nov 29 18:09:13 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, TLS: Connection closed, session=<71qQCLtElDmnXpI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Nov 29 18:09:16 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, TLS, session=<Kk+7CLtE2jmnXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-29 18:09:24 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:36120: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:09:43 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<VBVcCrtEDIIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 29 18:09:53 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<l833CrtELtuLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:12:18 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<vBWXE7tEuLADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:14:25 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<3vomG7tE+p4DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:17:06 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<3b3IJLtEHN8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:17:15 host2 dovecot[1796015]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<LsBPJbtEiJUDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 29 18:19:57 host2 sshd[2867100]: Disconnected from invalid user student1 200.46.125.168 port 24187 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 29 18:19:47 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<PoZeLrtE6MgDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-29 18:20:30 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:52804: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-11-29 18:20:42 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:64914: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-29 18:23:19 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:54530: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-11-29 18:23:40 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:34009: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 29 18:25:16 host2 sshd[2870207]: Disconnected from invalid user testuser 200.46.125.168 port 56376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-29 18:26:18 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:38253: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-29 18:26:36 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:37104: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 29 18:26:38 host2 sshd[2870846]: Disconnected from invalid user user 200.46.125.168 port 23874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.34.163.12
country_id: 130758
description:
Nov 29 18:27:20 host2 sshd[2871214]: Disconnected from invalid user ubuntu 46.34.163.12 port 42582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.34.163.12
country_id: 130758
description:
Nov 29 18:29:51 host2 sshd[2872628]: Disconnected from invalid user ubuntu 46.34.163.12 port 48346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 29 18:30:25 host2 sshd[2873116]: Disconnected from invalid user conectar 200.46.125.168 port 17044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 29 18:31:43 host2 sshd[2873747]: Disconnected from invalid user user10 200.46.125.168 port 32974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 18:32:03 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61802: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-29 18:33:06 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:43064: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2025-11-29 18:32:56 dovecot_login authenticator failed for 95-210-105-142.ip.skylogicnet.com [95.210.105.142]:44341: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.22.102
country_id: 6252001
description:
2025-11-29 18:34:01 dovecot_login authenticator failed for (ADMIN) [158.173.22.102]:29074: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 29 18:38:49 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<vy9tcrtEhtIiemm2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 29 18:40:47 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<jIZxebtEzv/CpRCj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.226.193.97
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.226.193.97 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.150.249.229
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.150.249.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.246.28.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.246.28.230 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.232.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.46.232.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.1.119.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.1.119.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.162.1.204
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.162.1.204 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.38
country_id: 2635167
description:
Nov 29 18:47:59 host2 dovecot[1796015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS, session=<psw3k7tEG8S594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 29 18:48:45 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TPrrlbtESP/CpRCj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-11-29 18:49:28 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:43866: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-29 18:51:16 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:41036: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-11-29 18:51:32 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:44694: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.144
country_id: 798549
description:
2025-11-29 18:54:23 dovecot_login authenticator failed for (ADMIN) [91.90.120.144]:4854: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 29 18:56:06 host2 sshd[2889007]: Disconnected from invalid user informix 103.172.20.218 port 44776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 29 18:57:21 host2 sshd[2890051]: Disconnected from invalid user halo 34.22.66.183 port 53392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 29 18:57:32 host2 sshd[2890116]: Disconnected from invalid user adam 103.172.20.218 port 35340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 29 18:58:46 host2 sshd[2890694]: Disconnected from invalid user pdx 34.22.66.183 port 57278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.192
country_id: 6252001
description:
2025-11-29 19:00:06 dovecot_login authenticator failed for ([208.69.161.192]) [208.69.161.192]:53692: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-29 18:59:56 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:2719: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 29 19:00:23 host2 sshd[2891923]: Disconnected from invalid user martin 103.172.20.218 port 53984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 29 19:01:55 host2 sshd[2892614]: Disconnected from invalid user sales1 103.172.20.218 port 50188 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 29 19:02:50 host2 pure-ftpd[2893192]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 19:03:50 host2 sshd[2894057]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-29 19:05:35 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:53318: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 29 19:07:33 host2 sshd[2896222]: Disconnected from invalid user testftp 103.172.20.218 port 38078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.68
country_id: 2963597
description:
2025-11-29 19:08:58 dovecot_login authenticator failed for (ADMIN) [155.2.194.68]:43123: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov 29 19:10:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, session=<etEo4rtE+/4t4/6b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.73
country_id: 1880251
description:
Nov 29 19:16:50 host2 sshd[2902713]: Disconnected from invalid user david 45.78.229.73 port 38784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 19:16:43 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<y4/T+btEEKQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 29 19:17:12 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<hHuL+7tETrYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-29 19:17:32 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:43751: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-11-29 19:18:26 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:63493: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-29 19:22:34 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:40462: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-11-29 19:22:48 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:51934: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.73
country_id: 1880251
description:
Nov 29 19:24:35 host2 sshd[2907065]: Disconnected from invalid user superman 45.78.229.73 port 33210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-29 19:24:58 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:34346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.62.58
country_id: 3017382
description:
2025-11-29 19:25:32 dovecot_login authenticator failed for ip58.ip-91-121-62.eu (ADMIN) [91.121.62.58]:55088: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.193.106.227
country_id: 357994
description:
Nov 29 19:28:46 host2 sshd[2909476]: Disconnected from invalid user sopuser 62.193.106.227 port 50314 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.62.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.45.62.114 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.58.240.166
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.58.240.166 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.210.120.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.210.120.203 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.210.157
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.231.210.157 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.180.182.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.180.182.237 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 29 19:36:46 host2 sshd[2913818]: Disconnected from invalid user syncthing 118.26.39.178 port 49938 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 29 19:38:20 host2 sshd[2914616]: Disconnected from invalid user vtatis 118.26.39.178 port 35240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.73
country_id: 1880251
description:
Nov 29 19:45:07 host2 sshd[2918857]: Disconnected from invalid user support 45.78.229.73 port 37578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.243
country_id: 6251999
description:
2025-11-29 19:45:56 dovecot_login authenticator failed for (ADMIN) [84.247.105.243]:32946: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-11-29 19:48:28 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:51206: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-11-29 19:48:27 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:50984: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.231
country_id: 6252001
description:
Nov 29 19:48:52 host2 pure-ftpd[2923010]: (?@195.184.76.231) [INFO] New connection from 195.184.76.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-29 19:48:56 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:58742: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.101.70
country_id: 3017382
description:
[2025-11-29 19:49:50 +0530] info [cpaneld] 161.97.101.70 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-29 19:51:10 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:41790: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.162
country_id: 2186224
description:
2025-11-29 19:50:46 dovecot_login authenticator failed for ([121.73.168.162]) [121.73.168.162]:45642: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-29 19:52:13 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:48270: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-29 19:52:34 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:53864: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 19:55:07 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:38095: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-29 19:55:18 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:50282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-29 20:02:15 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:57995: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-11-29 20:02:44 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:44246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.229.73
country_id: 1880251
description:
Nov 29 20:03:06 host2 sshd[2936385]: Disconnected from invalid user zabbix 45.78.229.73 port 55472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-11-29 20:04:08 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:56047: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-29 20:04:00 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:48062: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 20:08:17 host2 sshd[2939960]: Disconnected from invalid user braedon 62.60.131.157 port 61649 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 20:09:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<PO0GtbxE+OVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.8
country_id: 2589581
description:
2025-11-29 20:09:40 dovecot_login authenticator failed for (ADMIN) [176.125.228.8]:63430: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.77.204.90
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.77.204.90 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.137.33
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.55.137.33 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.39.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.182.39.218 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.131.34.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.131.34.105 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.166.81.115
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.166.81.115 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.129.229.245
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.129.229.245 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.97.95.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 152.97.95.116 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-29 20:11:45 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:36324: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-29 20:12:03 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:42133: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-11-29 20:13:53 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:60860: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-29 20:14:07 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:55695: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-29 20:17:08 dovecot_login authenticator failed for ([1.7.229.162]) [49.37.32.248]:50856: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-29 20:16:44 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:57178: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 20:19:58 host2 sshd[2947415]: Disconnected from invalid user braedon 62.60.131.157 port 60562 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.45
country_id: 6252001
description:
Nov 29 20:22:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.45, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<//2147xER8Ki2JYt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.45
country_id: 6252001
description:
Nov 29 20:23:02 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.45, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gv8l57xEDvmi2JYt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.45
country_id: 6252001
description:
Nov 29 20:23:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.45, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<LqSx57xEAOui2JYt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-11-29 20:25:27 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:42820: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.69
country_id: 783754
description:
2025-11-29 20:26:42 dovecot_login authenticator failed for (ADMIN) [31.171.154.69]:40836: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 29 20:29:55 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<jyjG/7xEHA5BMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.45
country_id: 6252001
description:
Nov 29 20:30:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.45, lip=66.85.158.92, TLS, session=<eVF0AL1E1Pyi2JYt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.45
country_id: 6252001
description:
Nov 29 20:30:35 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.45, lip=66.85.158.92, TLS, session=<+QomAr1EsOOi2JYt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 29 20:30:26 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<V3KXAb1EwLFBMRRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 29 20:32:51 host2 sshd[2956116]: Disconnected from invalid user elena 197.5.145.73 port 54902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 20:33:46 host2 sshd[2956616]: Disconnected from invalid user  2.57.121.112 port 61159 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.159
country_id: 1880251
description:
Nov 29 20:36:07 host2 sshd[2958050]: Disconnected from invalid user radarr 45.78.205.159 port 36944 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-11-29 20:36:56 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:55460: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 29 20:38:47 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<l9hZH71EUOh283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.128
country_id: 3686110
description:
Nov 29 20:39:07 host2 sshd[2959986]: Disconnected from invalid user gerrit 190.108.79.128 port 48687 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 29 20:39:12 host2 sshd[2960016]: Disconnected from invalid user ubuntu 197.5.145.73 port 54907 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.229
country_id: 1819730
description:
2025-11-29 20:40:54 dovecot_login authenticator failed for (ADMIN) [86.107.104.229]:8631: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.108.79.128
country_id: 3686110
description:
Nov 29 20:40:37 host2 sshd[2961032]: Disconnected from invalid user alex 190.108.79.128 port 50296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 29 20:41:31 host2 sshd[2961513]: Disconnected from invalid user sammy 197.5.145.73 port 54909 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.159
country_id: 1880251
description:
Nov 29 20:44:04 host2 sshd[2963075]: Disconnected from invalid user mcserver 45.78.205.159 port 53046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.183.66
country_id: 2215636
description:
Nov 29 20:44:28 host2 sshd[2963317]: Disconnected from invalid user steam 102.213.183.66 port 52444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 29 20:46:07 host2 sshd[2964992]: Disconnected from invalid user esuser 177.85.247.230 port 13242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.159
country_id: 1880251
description:
Nov 29 20:46:27 host2 sshd[2965138]: Disconnected from invalid user admin 45.78.205.159 port 33470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 29 20:46:49 host2 sshd[2965387]: Disconnected from invalid user 123 12.156.67.18 port 60684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 29 20:47:17 host2 sshd[2965738]: Disconnected from invalid user userroot 197.5.145.73 port 54914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 29 20:47:40 host2 sshd[2966082]: Disconnected from invalid user lab 177.85.247.230 port 30336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 29 20:48:05 host2 sshd[2966346]: Disconnected from invalid user developer 12.156.67.18 port 59456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-29 20:48:07 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:34314: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.183.66
country_id: 2215636
description:
Nov 29 20:48:00 host2 sshd[2966262]: Disconnected from invalid user esuser 102.213.183.66 port 51958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.183.66
country_id: 2215636
description:
Nov 29 20:49:15 host2 sshd[2966950]: Disconnected from invalid user svn 102.213.183.66 port 53868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.128
country_id: 3686110
description:
Nov 29 20:49:42 host2 sshd[2967152]: Disconnected from invalid user mcserver 190.108.79.128 port 13899 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.159
country_id: 1880251
description:
Nov 29 20:51:06 host2 sshd[2968200]: Disconnected from invalid user odoo17 45.78.205.159 port 55646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.213.183.66
country_id: 2215636
description:
Nov 29 20:50:28 host2 sshd[2967797]: Disconnected from invalid user vbox 102.213.183.66 port 44400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.183.66
country_id: 2215636
description:
Nov 29 20:51:45 host2 sshd[2968512]: Disconnected from invalid user test123 102.213.183.66 port 37570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 29 20:52:28 host2 sshd[2968892]: Disconnected from invalid user svn 12.156.67.18 port 43056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 29 20:54:44 host2 sshd[2970870]: Disconnected from invalid user s 12.156.67.18 port 44224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.106.41
country_id: 2623032
description:
2025-11-29 20:57:00 dovecot_login authenticator failed for (ADMIN) [46.246.106.41]:38802: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-29 20:57:01 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:45868: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-29 20:57:26 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:47971: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.29
country_id: 1733045
description:
2025-11-29 20:57:48 dovecot_login authenticator failed for ([49.124.151.29]) [49.124.151.29]:39474: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.155
country_id: 6252001
description:
Nov 29 20:58:39 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.155, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<TheHZr1EY8ei2Jab>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.143
country_id: 1733045
description:
2025-11-29 20:59:27 dovecot_login authenticator failed for ([49.124.152.143]) [49.124.152.143]:46294: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.155
country_id: 6252001
description:
Nov 29 20:59:40 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=162.216.150.155, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<FFIear1EAO6i2Jab>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-29 20:59:44 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:37174: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-29 21:00:02 dovecot_login authenticator failed for ([125.17.198.105]) [125.19.251.90]:37230: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.155
country_id: 6252001
description:
Nov 29 21:00:11 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.150.155, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<LjACbL1Eouai2Jab>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 21:02:03 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Hq2Rcr1EVSZRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Nov 29 21:04:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.212, lip=66.85.158.91, session=</+k4er1E5bhBMQHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov 29 21:06:12 host2 sshd[2979071]: Disconnected from invalid user hadoop 45.249.245.22 port 42124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.90.100.147
country_id: 192950
description:
Nov 29 21:06:21 host2 sshd[2979156]: Disconnected from invalid user es 41.90.100.147 port 46716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.155
country_id: 6252001
description:
Nov 29 21:08:13 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.155, lip=66.85.158.91, TLS, session=<ZtK8iL1E9vGi2Jab>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.155
country_id: 6252001
description:
Nov 29 21:09:15 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.155, lip=66.85.158.91, TLS, session=<0BZjjL1EgOGi2Jab>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.90.100.147
country_id: 192950
description:
Nov 29 21:09:54 host2 sshd[2981286]: Disconnected from invalid user shree 41.90.100.147 port 44830 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-29 21:10:58 H=([92.246.87.86]) [92.246.87.86]:59299 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<towgreen.inc@outlook.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.90.100.147
country_id: 192950
description:
Nov 29 21:11:26 host2 sshd[2982460]: Disconnected from invalid user runner 41.90.100.147 port 60041 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov 29 21:11:35 host2 sshd[2982590]: Disconnected from invalid user django 45.249.245.22 port 56648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Nov 29 21:11:38 host2 sshd[2982628]: Disconnected from invalid user runner 85.206.171.113 port 55676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 29 21:13:48 host2 sshd[2984398]: Disconnected from invalid user django 162.214.126.1 port 33968 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Nov 29 21:13:57 host2 sshd[2984435]: Disconnected from invalid user superadmin 85.206.171.113 port 39354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov 29 21:14:19 host2 sshd[2984649]: Disconnected from invalid user dixi 45.249.245.22 port 58162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 29 21:14:52 host2 sshd[2984974]: Disconnected from invalid user taibabi 162.214.126.1 port 33226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.32
country_id: 2589581
description:
2025-11-29 21:15:12 dovecot_login authenticator failed for (ADMIN) [176.125.228.32]:61821: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov 29 21:15:34 host2 sshd[2985622]: Disconnected from invalid user backend 45.249.245.22 port 32862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.6.218.173
country_id: 3595528
description:
2025-11-29 21:15:53 dovecot_login authenticator failed for 173.218.6.200.static.intelnet.net.gt [200.6.218.173]:45257: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Nov 29 21:17:11 host2 sshd[2986394]: Disconnected from invalid user ali 85.206.171.113 port 48990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-29 21:18:05 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:56889: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.192.140.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.192.140.36 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.98.90.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 16.98.90.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.21.159
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.147.21.159 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.93.90.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.93.90.53 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.211.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.58.211.246 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Nov 29 21:20:47 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wxaltb1E9q5APsW2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.90.100.147
country_id: 192950
description:
Nov 29 21:20:23 host2 sshd[2988335]: Disconnected from invalid user share 41.90.100.147 port 38379 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.184
country_id: 6252001
description:
Nov 29 21:20:29 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.184, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WbOStL1EjS1APsW4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 29 21:25:19 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS: Connection closed, session=<4Vnlxb1EMqZChJmB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.248
country_id: 3469034
description:
Nov 29 21:29:09 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=191.53.128.248, lip=66.85.158.91, TLS, session=<kJ1K0r1E5ee/NYD4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.240
country_id: 953987
description:
Nov 29 21:29:44 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<amila>, method=PLAIN, rip=102.64.34.240, lip=66.85.158.91, TLS, session=<n99c1L1E3Z9mQCLw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-29 21:31:55 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:58567: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-29 21:32:55 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:44210: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.194.198
country_id: 2077456
description:
2025-11-29 21:33:15 dovecot_login authenticator failed for (ADMIN) [173.239.194.198]:9305: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-29 21:34:22 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:5894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.204.42
country_id: 1210997
description:
2025-11-29 21:34:38 dovecot_login authenticator failed for ([103.245.204.42]) [103.245.204.42]:32862: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2025-11-29 21:34:12 dovecot_login authenticator failed for ([5.11.161.152]) [5.11.161.152]:39513: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 29 21:35:23 host2 sshd[2997352]: Disconnected from invalid user bryn 62.60.131.157 port 44406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-29 21:42:13 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:50114: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.212.234
country_id: 1269750
description:
2025-11-29 21:44:43 dovecot_plain authenticator failed for (JKJEX) [49.204.212.234]:37553: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-29 21:46:43 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:53710: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 21:57:39 host2 sshd[3025291]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 29 21:58:15 host2 sshd[3025732]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 58244


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.69.10.175
country_id: 6252001
description:
[2025-11-29 21:58:17 +0530] info [cpaneld] 38.69.10.175 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.120.101
country_id: 6252001
description:
Nov 29 22:00:08 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.168.120.101, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9k9gQr5EPsQUqHhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-11-29 22:01:14 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:41345: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-29 22:01:13 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:39754: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-29 22:01:28 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:38528: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-29 22:03:00 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:52422: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-29 22:04:07 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:33729: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-29 22:03:19 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:44179: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 29 22:04:09 host2 sshd[3029280]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 61269


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.150.79
country_id: 6252001
description:
Nov 29 22:05:12 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.150.79, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2PGCVL5EYqQUU5ZP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.227
country_id: 6252001
description:
Nov 29 22:05:45 host2 pure-ftpd[3030295]: (?@64.62.197.227) [INFO] New connection from 64.62.197.227


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 22:06:26 host2 sshd[3030597]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.144.131.108
country_id: 3469034
description:
2025-11-29 22:08:35 dovecot_login authenticator failed for (177-172-15-62.user.vivozap.com.br) [177.144.131.108]:11728: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.253.31
country_id: 1269750
description:
2025-11-29 22:16:55 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [103.177.253.31]:6148: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-29 22:17:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58526: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.135.73
country_id: 6252001
description:
Nov 29 22:21:49 host2 dovecot[1796015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.135.73, lip=66.85.158.91, session=<aY3yj75E4DOlmodJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.135.73
country_id: 6252001
description:
Nov 29 22:21:48 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.135.73, lip=66.85.158.91, session=<dCrij75EuDKlmodJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.18
country_id: 6290252
description:
2025-11-29 22:22:27 dovecot_login authenticator failed for (ADMIN) [37.46.115.18]:60742: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-11-29 22:23:01 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:51798: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 29 22:26:48 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pKO/ob5EYuZAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 29 22:26:55 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+wIkor5EpoVAPsVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.43
country_id: 6252001
description:
Nov 29 22:27:07 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.43, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K9Hcor5EeT1APpwr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 29 22:27:15 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HUhio75EukZAPsVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 29 22:27:17 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS: Connection closed, session=<NPR9o75EdodAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Nov 29 22:27:24 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ufbfo75E9LtAPpwm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.194
country_id: 1269750
description:
2025-11-29 22:28:37 dovecot_login authenticator failed for ([127.0.0.1]) [125.20.245.194]:37744: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2025-11-29 22:28:51 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.123.50]:54566: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.72
country_id: 1733045
description:
2025-11-29 22:29:49 dovecot_login authenticator failed for ([49.124.151.72]) [49.124.151.72]:44556: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.192.233.60
country_id: 1269750
description:
Nov 29 22:34:52 host2 sshd[3046307]: Disconnected from invalid user tidb 117.192.233.60 port 48095 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.123
country_id: 6252001
description:
Nov 29 22:35:13 host2 pure-ftpd[3046720]: (?@198.235.24.123) [INFO] New connection from 198.235.24.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.58.158.205
country_id: 1269750
description:
2025-11-29 22:35:49 dovecot_plain authenticator failed for (V4836VC8A) [152.58.158.205]:62882: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.157
country_id: 2782113
description:
2025-11-29 22:38:14 dovecot_login authenticator failed for (ADMIN) [156.146.60.157]:27384: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.208
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.208: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 29 22:39:44 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<AuYI0L5EJIjY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 29 22:40:12 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<PmCy0b5EbovY2s5D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 22:43:09 host2 sshd[3052050]: Disconnected from invalid user  2.57.121.112 port 61685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-29 22:46:21 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:60049: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-29 22:46:30 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:50474: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2025-11-29 22:51:31 dovecot_login authenticator failed for (abts-mum-static-094.97.170.122.airtelbroadband.in) [122.170.97.94]:46441: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-29 22:51:20 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:39460: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.233.60
country_id: 1269750
description:
Nov 29 22:52:11 host2 sshd[3061378]: Disconnected from invalid user ubuntu 117.192.233.60 port 43791 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.79
country_id: 2921044
description:
2025-11-29 22:54:06 dovecot_login authenticator failed for (ADMIN) [212.102.57.79]:48150: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-11-29 22:55:14 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:54541: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-29 22:55:28 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:51800: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.243.250.52
country_id: 2589581
description:
2025-11-29 22:56:41 dovecot_plain authenticator failed for ([89.116.164.85]) [154.243.250.52]:35771: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 22:59:26 host2 sshd[3066659]: Disconnected from invalid user admin 2.57.121.112 port 15040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.166.202.21
country_id: 6252001
description:
2025-11-29 23:01:38 dovecot_plain authenticator failed for c-73-166-202-21.hsd1.tx.comcast.net ([89.116.164.85]) [73.166.202.21]:36504: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.66.245.140
country_id: 3469034
description:
2025-11-29 23:03:28 dovecot_plain authenticator failed for (AM2GM97U1Z7) [187.66.245.140]:63055: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-29 23:07:37 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:58424: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.227
country_id: 6252001
description:
Nov 29 23:07:44 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.227, lip=66.85.158.91, session=<4SQnNL9Etpes7OTj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-11-29 23:07:47 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:50986: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-11-29 23:08:08 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:47210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-29 23:09:01 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:37840: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-29 23:08:32 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:38532: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.23
country_id: 6290252
description:
2025-11-29 23:10:31 dovecot_login authenticator failed for (ADMIN) [37.46.115.23]:37534: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.69
country_id: 6252001
description:
Nov 29 23:10:33 host2 pure-ftpd[3072894]: (?@198.235.24.69) [INFO] New connection from 198.235.24.69


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.12
country_id: 3017382
description:
Nov 29 23:14:52 host2 pure-ftpd[3076192]: (?@91.196.152.12) [INFO] New connection from 91.196.152.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-29 23:19:41 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:41510: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-29 23:20:04 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:38355: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.93.0.125
country_id: 3624060
description:
2025-11-29 23:21:49 dovecot_plain authenticator failed for ([89.116.164.85]) [177.93.0.125]:16961: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.57
country_id: 3625428
description:
2025-11-29 23:24:04 dovecot_login authenticator failed for (ADMIN) [95.181.237.57]:46796: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 29 23:24:30 host2 pure-ftpd[3081516]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-29 23:31:22 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:56590: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-29 23:31:35 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:57512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 29 23:31:47 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<3mYBir9EITxRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-29 23:40:28 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:45548: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.247.222.220
country_id: 6252001
description:
Nov 29 23:40:32 host2 sshd[3091154]: Disconnected from invalid user onkar 52.247.222.220 port 49076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 29 23:41:41 host2 sshd[3091891]: Disconnected from invalid user admin 2.57.121.112 port 31303 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.24
country_id: 798549
description:
2025-11-29 23:42:01 dovecot_login authenticator failed for (ADMIN) [143.244.54.24]:43213: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-29 23:42:36 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53522: 535 Incorrect authentication data (set_id=consultas@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-29 23:42:47 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:44324: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2025-11-29 23:42:58 dovecot_login authenticator failed for 45-238-2-7.netmaisfibra.net.br [45.238.2.7]:49920: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-29 23:45:54 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:34166: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.13.218.108
country_id: 6252001
description:
Nov 29 23:46:06 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=52.13.218.108, lip=66.85.158.92, TLS: Connection closed, session=<iJ9Vvb9EgJs0Ddps>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 23:46:33 host2 sshd[3094998]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-29 23:46:16 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:43452: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.48.82
country_id: 130758
description:
2025-11-29 23:53:44 dovecot_login authenticator failed for ([185.187.48.82]) [185.187.48.82]:55934: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-29 23:53:55 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:41958: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 29 23:55:07 host2 sshd[3101578]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.247.222.220
country_id: 6252001
description:
Nov 29 23:58:59 host2 sshd[3103688]: Disconnected from invalid user steam 52.247.222.220 port 50986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.144
country_id: 2077456
description:
2025-11-30 00:03:21 dovecot_login authenticator failed for (ADMIN) [179.61.228.144]:19211: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.74.255.107
country_id: 3625428
description:
2025-11-30 00:05:54 dovecot_plain authenticator failed for ([89.116.164.85]) [38.74.255.107]:10292: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-30 00:06:19 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:48978: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-30 00:06:31 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3549: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.115
country_id: 6252001
description:
Nov 30 00:06:40 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.115, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<J1LgBsBEr9+TuYRz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.110
country_id: 6252001
description:
Nov 30 00:08:08 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.207.110, lip=66.85.158.91, session=<ZRUrDMBE4LUtT89u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.64.122.187
country_id: 6252001
description:
2025-11-30 00:10:33 dovecot_plain authenticator failed for 170-64-122-187.asl01-oa11.asl.ne.allofiber.net ([89.116.164.85]) [170.64.122.187]:57895: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.203.233
country_id: 6251999
description:
Nov 30 00:16:26 host2 pure-ftpd[3114439]: (?@128.203.203.233) [INFO] New connection from 128.203.203.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-30 00:16:33 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:36290: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-30 00:16:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:53464: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.156
country_id: 1210997
description:
2025-11-30 00:20:51 dovecot_login authenticator failed for (ADMIN) [64.64.112.156]:31679: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-30 00:23:23 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:45358: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-30 00:24:06 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:38242: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.247.222.220
country_id: 6252001
description:
Nov 30 00:26:02 host2 sshd[3120248]: Disconnected from invalid user user01 52.247.222.220 port 40586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-11-30 00:28:15 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:54336: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-30 00:28:36 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:60736: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 00:29:57 host2 sshd[3122913]: Disconnected from invalid user telecomadmin 2.57.121.112 port 62139 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.215.136.220
country_id: 6252001
description:
Nov 30 00:34:13 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.215.136.220, lip=66.85.158.91, TLS: Connection closed, session=<rKhwacBE9LQ214jc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-11-30 00:40:23 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:41131: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-30 00:40:06 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:55516: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.179
country_id: 1694008
description:
2025-11-30 00:41:42 dovecot_login authenticator failed for (ADMIN) [188.214.125.179]:9304: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-30 00:44:28 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:49764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-30 00:44:51 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:45686: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Nov 30 00:45:31 host2 sshd[3132758]: Disconnected from invalid user halo 160.251.172.221 port 59040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Nov 30 00:49:43 host2 sshd[3134931]: Disconnected from invalid user ir 200.108.174.4 port 59946 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 00:50:05 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<7HoNosBEkjVRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Nov 30 00:49:37 host2 sshd[3134894]: Disconnected from invalid user rstudio 160.251.172.221 port 40902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Nov 30 00:51:09 host2 sshd[3135991]: Disconnected from invalid user syncthing 200.108.174.4 port 58640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-30 00:51:22 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:37496: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Nov 30 00:51:02 host2 sshd[3135871]: Disconnected from invalid user qw 160.251.172.221 port 48202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-30 00:51:38 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:55150: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-11-30 00:51:39 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:51108: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Nov 30 00:52:23 host2 sshd[3136697]: Disconnected from invalid user nrk 160.251.172.221 port 44230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Nov 30 00:52:33 host2 sshd[3136751]: Disconnected from invalid user ctf 200.108.174.4 port 41412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Nov 30 00:53:42 host2 sshd[3137402]: Disconnected from invalid user terraria 160.251.172.221 port 56744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Nov 30 00:53:54 host2 sshd[3137500]: Disconnected from invalid user elemental 200.108.174.4 port 39462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 00:56:10 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sUPTt8BEwIYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.157
country_id: 6252001
description:
Nov 30 00:56:53 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.157, lip=66.85.158.91, session=<V6J9usBE7OlC5DWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 00:59:04 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<t8c0wsBE8uMXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.55
country_id: 3865483
description:
2025-11-30 01:01:39 dovecot_login authenticator failed for (ADMIN) [146.70.38.55]:35756: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-30 01:02:58 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:34874: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-30 01:03:08 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:40834: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-30 01:03:11 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:37140: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-30 01:03:31 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:43944: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-11-30 01:03:35 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.168.117]:59261: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-11-30 01:03:42 dovecot_login authenticator failed for ([127.0.0.1]) [84.213.187.240]:32800: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-30 01:05:10 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:43648: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-30 01:05:31 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:48148: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-11-30 01:06:51 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:40120: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-30 01:07:00 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:12726: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.165
country_id: 2635167
description:
Nov 30 01:09:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.165, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PXlV6MBEteBX7LCl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.12
country_id: 2635167
description:
Nov 30 01:09:41 host2 dovecot[1796015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.12, lip=66.85.158.92, TLS, session=<5i9J6MBEj5BX7LAM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.147
country_id: 2635167
description:
Nov 30 01:10:15 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LjFR6sBEa9pX7LCT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.153
country_id: 2635167
description:
Nov 30 01:10:49 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.153, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<TqtM7MBE255X7LCZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.163
country_id: 2635167
description:
Nov 30 01:11:22 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.163, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<nixI7sBECctX7LCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.169
country_id: 2635167
description:
Nov 30 01:11:55 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.169, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fRdE8MBEnatX7LCp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.149
country_id: 2635167
description:
Nov 30 01:12:28 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.149, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qgE+8sBEHaVX7LCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.166
country_id: 2635167
description:
Nov 30 01:13:02 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.166, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<3XM79MBE/Ya594mm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-30 01:13:04 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:38347: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.147
country_id: 2635167
description:
Nov 30 01:14:08 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.147, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<97gw+MBEXZ6594mT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-11-30 01:13:32 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:51482: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.165
country_id: 2635167
description:
Nov 30 01:13:35 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.165, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uEs39sBE/eBX7LCl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.250.132.115
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 160.250.132.115 - 2096 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.164
country_id: 2635167
description:
Nov 30 01:14:41 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JQks+sBEhai594mk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 30 01:16:49 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<1hzAAcFElKNChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.68
country_id: 390903
description:
2025-11-30 01:18:32 dovecot_login authenticator failed for (ADMIN) [79.127.181.68]:22752: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 01:20:19 host2 sshd[3154515]: Disconnected from invalid user admin 2.57.121.112 port 32888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-30 01:26:36 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:33410: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 30 01:32:36 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, session=<ccczOsFEOPFChJlw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 01:33:45 host2 sshd[3162821]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 30 01:34:17 host2 sshd[3163081]: Disconnected from invalid user copia 92.191.96.115 port 30884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.240.205.105
country_id: 6252001
description:
2025-11-30 01:34:29 dovecot_login authenticator failed for (ADMIN) [151.240.205.105]:45202: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 30 01:33:43 host2 sshd[3162797]: Disconnected from invalid user minecraft 167.71.204.253 port 60208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 30 01:35:12 host2 sshd[3163762]: Disconnected from invalid user roott 156.238.252.133 port 40490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 01:35:36 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<nzTURMFE+IZRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 30 01:35:50 host2 sshd[3164243]: Disconnected from invalid user osboxes 167.71.204.253 port 47652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 30 01:37:07 host2 sshd[3164936]: Disconnected from invalid user int 167.71.204.253 port 57254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-30 01:38:02 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:59548: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 30 01:38:08 host2 sshd[3165471]: Disconnected from invalid user hamed 92.191.96.115 port 61716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-30 01:38:17 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:39640: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 30 01:39:24 host2 sshd[3166249]: Disconnected from invalid user jmarquez 134.209.225.104 port 53584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 30 01:40:27 host2 sshd[3166993]: Disconnected from invalid user q 156.236.74.199 port 54506 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 30 01:40:29 host2 sshd[3167022]: Disconnected from invalid user ventas01 134.209.225.104 port 49910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 30 01:40:47 host2 sshd[3167198]: Disconnected from invalid user ventas01 92.191.96.115 port 6016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 30 01:40:52 host2 sshd[3167245]: Disconnected from invalid user monitor 167.71.204.253 port 35720 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 01:42:17 host2 sshd[3168159]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 30 01:41:32 host2 sshd[3167723]: Disconnected from invalid user odoo15 134.209.225.104 port 39680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 30 01:41:59 host2 sshd[3167955]: Disconnected from invalid user sammy 92.191.96.115 port 26266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 30 01:44:43 host2 sshd[3169539]: Disconnected from invalid user tom 156.238.252.133 port 45516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 30 01:44:55 host2 sshd[3169679]: Disconnected from invalid user oracle 156.236.74.199 port 54516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 30 01:45:52 host2 sshd[3171072]: Disconnected from invalid user ts2 156.238.252.133 port 50912 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 30 01:46:22 host2 sshd[3171453]: Disconnected from invalid user user 156.236.74.199 port 58718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 30 01:47:01 host2 sshd[3171778]: Disconnected from invalid user mcserver 156.238.252.133 port 50848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Nov 30 01:47:39 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.217, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SrgJcMFEutjG6xjZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.55.60.167
country_id: 6252001
description:
Nov 30 01:47:48 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=69.55.60.167, lip=66.85.158.91, session=<u+SPcMFETqNFNzyn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-30 01:49:52 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:49511: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 30 01:50:40 host2 sshd[3173945]: Disconnected from invalid user cgpexpert 189.112.0.11 port 37338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.169
country_id: 2921044
description:
2025-11-30 01:51:25 dovecot_login authenticator failed for (ADMIN) [212.102.57.169]:13808: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-11-30 01:53:10 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:60246: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Nov 30 01:53:16 host2 sshd[3175532]: Disconnected from invalid user temp 27.50.25.190 port 35112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-30 01:52:49 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:60304: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 30 01:54:03 host2 sshd[3175898]: Disconnected from invalid user temp 101.47.143.192 port 40638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.63
country_id: 798544
description:
Nov 30 01:54:16 host2 sshd[3176435]: Disconnected from invalid user bot 83.168.69.63 port 48258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Nov 30 01:55:17 host2 sshd[3177566]: Disconnected from invalid user local 27.50.25.190 port 59436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-30 01:55:28 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:37727: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 30 01:56:01 host2 sshd[3177916]: Disconnected from invalid user server 189.112.0.11 port 33686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-30 01:57:13 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:43978: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-30 01:57:25 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:47595: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Nov 30 01:56:39 host2 sshd[3178305]: Disconnected from invalid user deploy 27.50.25.190 port 58128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 30 01:56:43 host2 sshd[3178316]: Disconnected from invalid user ctf 101.47.143.192 port 58904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-30 01:57:53 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:47242: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-30 01:57:57 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:37093: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-30 01:58:13 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:49875: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-30 01:58:26 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:49899: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.63
country_id: 798544
description:
Nov 30 01:57:40 host2 sshd[3178986]: Disconnected from invalid user usuario2 83.168.69.63 port 45652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-30 01:57:42 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:56990: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-30 01:58:36 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:45122: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 30 01:58:47 host2 sshd[3179584]: Disconnected from invalid user github 189.112.0.11 port 59198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.69.63
country_id: 798544
description:
Nov 30 01:58:51 host2 sshd[3179626]: Disconnected from invalid user deploy 83.168.69.63 port 42368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.172.229.129
country_id: 3017382
description:
Nov 30 01:58:53 host2 sshd[3179640]: Disconnected from invalid user test 163.172.229.129 port 60820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Nov 30 01:59:16 host2 sshd[3179905]: Disconnected from invalid user qiyuesuo 27.50.25.190 port 40268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 30 01:59:21 host2 sshd[3179962]: Disconnected from invalid user superadmin 186.103.169.12 port 52428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.32.144.232
country_id: 6252001
description:
2025-11-30 02:01:10 dovecot_login authenticator failed for (syn-065-032-144-232.res.spectrum.com) [65.32.144.232]:51666: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-11-30 02:01:21 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:50366: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Nov 30 02:00:48 host2 sshd[3180972]: Disconnected from invalid user elemental 212.154.234.9 port 55914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 30 02:00:53 host2 sshd[3181011]: Disconnected from invalid user myuser 186.103.169.12 port 41786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Nov 30 02:02:08 host2 sshd[3181698]: Disconnected from invalid user fred 212.154.234.9 port 54165 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 30 02:02:28 host2 sshd[3181876]: Disconnected from invalid user fred 186.103.169.12 port 59700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.172.229.129
country_id: 3017382
description:
Nov 30 02:02:42 host2 sshd[3181986]: Disconnected from invalid user minecraft 163.172.229.129 port 44244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 30 02:02:52 host2 sshd[3182062]: Disconnected from invalid user superadmin 103.179.217.33 port 33956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 30 02:04:09 host2 sshd[3183562]: Disconnected from invalid user posiflex 103.179.217.33 port 42494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 30 02:04:29 host2 sshd[3183757]: Disconnected from invalid user elemental 101.47.143.192 port 39330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 02:03:35 host2 sshd[3183244]: Disconnected from invalid user  2.57.121.112 port 62056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 30 02:03:58 host2 sshd[3183434]: Disconnected from invalid user kiosk 186.103.169.12 port 46488 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Nov 30 02:05:04 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.83, lip=66.85.158.92, TLS, session=<pnZZrsFErOrN0h9T>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 30 02:05:26 host2 sshd[3184567]: Disconnected from invalid user kiosk 103.179.217.33 port 51870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 30 02:05:38 host2 sshd[3184735]: Disconnected from invalid user odin 186.103.169.12 port 45892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Nov 30 02:07:20 host2 sshd[3185900]: Disconnected from invalid user radarr 212.154.234.9 port 23351 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.172.229.129
country_id: 3017382
description:
Nov 30 02:06:51 host2 sshd[3185435]: Disconnected from invalid user ts 163.172.229.129 port 60654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 30 02:06:59 host2 sshd[3185531]: Disconnected from invalid user deploy 101.47.143.192 port 59128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.41
country_id: 3865483
description:
2025-11-30 02:08:30 dovecot_login authenticator failed for (ADMIN) [146.70.38.41]:17080: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 02:08:10 host2 sshd[3186795]: Disconnected from invalid user mikala 62.60.131.157 port 48658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-30 02:10:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54475: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.172.229.129
country_id: 3017382
description:
Nov 30 02:10:49 host2 sshd[3188846]: Disconnected from invalid user test2 163.172.229.129 port 42718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 30 02:11:07 host2 sshd[3189034]: Disconnected from invalid user bot 202.165.16.9 port 55422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 30 02:13:29 host2 sshd[3190696]: Disconnected from invalid user tom 213.55.85.202 port 3459 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 30 02:15:09 host2 sshd[3191868]: Disconnected from invalid user ariel 202.165.16.9 port 40180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.194.101.210
country_id: 1269750
description:
Nov 30 02:15:19 host2 sshd[3192025]: Disconnected from invalid user admin 14.194.101.210 port 50106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 02:15:50 host2 sshd[3192289]: Disconnected from invalid user ubnt 2.57.121.112 port 62467 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 30 02:16:40 host2 sshd[3192739]: Disconnected from invalid user apacher 202.165.16.9 port 53450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 30 02:19:33 host2 sshd[3194358]: Disconnected from invalid user cyril 103.101.225.22 port 54540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 30 02:21:05 host2 sshd[3195316]: Disconnected from invalid user hdfs 103.101.225.22 port 49240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.194.101.210
country_id: 1269750
description:
Nov 30 02:20:40 host2 sshd[3195106]: Disconnected from invalid user peter 14.194.101.210 port 50636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Nov 30 02:20:49 host2 sshd[3195190]: Disconnected from invalid user roland 89.44.137.176 port 51566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 30 02:22:27 host2 sshd[3196076]: Disconnected from invalid user ivan 103.101.225.22 port 56152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 30 02:22:49 host2 sshd[3196350]: Disconnected from invalid user frappe 213.55.85.202 port 3464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Nov 30 02:22:57 host2 sshd[3196415]: Disconnected from invalid user master 89.44.137.176 port 48740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 30 02:23:45 host2 sshd[3196817]: Disconnected from invalid user lucas 103.101.225.22 port 35322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 30 02:24:18 host2 sshd[3197327]: Disconnected from invalid user andy 213.55.85.202 port 3465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 30 02:25:05 host2 sshd[3197980]: Disconnected from invalid user wordpress 103.101.225.22 port 57964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.194.101.210
country_id: 1269750
description:
Nov 30 02:25:24 host2 sshd[3198221]: Disconnected from invalid user drcom 14.194.101.210 port 41140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.136
country_id: 3041565
description:
2025-11-30 02:27:38 dovecot_login authenticator failed for (ADMIN) [173.239.217.136]:45550: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Nov 30 02:27:23 host2 sshd[3199787]: Disconnected from invalid user thomas 89.44.137.176 port 43156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.194.101.210
country_id: 1269750
description:
Nov 30 02:30:08 host2 sshd[3201582]: Disconnected from invalid user user6 14.194.101.210 port 44048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 30 02:30:20 host2 sshd[3201770]: Disconnected from invalid user grid 213.55.85.202 port 3469 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Nov 30 02:31:02 host2 sshd[3202049]: Disconnected from invalid user angel 45.78.226.65 port 33898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-30 02:35:47 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:54798: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.65
country_id: 1880251
description:
Nov 30 02:35:57 host2 sshd[3205191]: Disconnected from invalid user sinusbot 45.78.226.65 port 44928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-11-30 02:36:21 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:37856: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-30 02:39:59 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:57084: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-30 02:39:20 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:44760: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.156
country_id: 2635167
description:
2025-11-30 02:43:21 dovecot_login authenticator failed for (ADMIN) [98.159.234.156]:44648: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 30 02:47:07 host2 pure-ftpd[3211819]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-11-30 02:51:03 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:39376: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-30 02:51:16 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:47212: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.65
country_id: 6252001
description:
Nov 30 02:52:12 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.65, lip=66.85.158.91, session=<ymbqVsJEOOzG6xhB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 02:54:18 host2 sshd[3215866]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.39
country_id: 3042225
description:
2025-11-30 02:59:35 dovecot_login authenticator failed for (ADMIN) [91.90.124.39]:4454: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 03:05:59 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<T9kWiMJEeKUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-30 03:07:42 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:34968: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-11-30 03:07:59 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:53086: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-30 03:09:03 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:52999: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-30 03:09:17 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:39956: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 03:09:50 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CIrWlcJEnI0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.90.230
country_id: 3895114
description:
2025-11-30 03:11:31 dovecot_plain authenticator failed for (E7G74M1Q) [186.189.90.230]:21378: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.166
country_id: 6252001
description:
2025-11-30 03:15:15 dovecot_login authenticator failed for (ADMIN) [140.228.24.166]:26346: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.224.13
country_id: 6252001
description:
Nov 30 03:17:38 host2 sshd[3229441]: Disconnected from invalid user ivan 167.172.224.13 port 46010 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 03:21:02 host2 sshd[3231721]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.224.13
country_id: 6252001
description:
Nov 30 03:20:18 host2 sshd[3230971]: Disconnected from invalid user lch 167.172.224.13 port 39014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.224.13
country_id: 6252001
description:
Nov 30 03:21:27 host2 sshd[3231974]: Disconnected from invalid user userm 167.172.224.13 port 42548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.224.13
country_id: 6252001
description:
Nov 30 03:22:32 host2 sshd[3232475]: Disconnected from invalid user erpnext 167.172.224.13 port 59044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-11-30 03:22:56 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:46722: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-11-30 03:23:09 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:64269: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.224.13
country_id: 6252001
description:
Nov 30 03:24:37 host2 sshd[3233596]: Disconnected from invalid user roott 167.172.224.13 port 46372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-30 03:27:04 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:33158: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 03:29:32 host2 sshd[3236276]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.72
country_id: 3374766
description:
2025-11-30 03:32:16 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:43455: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.53
country_id: 2629691
description:
2025-11-30 03:33:09 dovecot_login authenticator failed for (ADMIN) [45.133.193.53]:49071: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-11-30 03:36:08 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.10.140]:43983: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 30 03:35:28 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<vzyf8cJEqNVChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.46.80.135
country_id: 2921044
description:
2025-11-30 03:36:20 dovecot_login authenticator failed for ([127.0.0.1]) [89.46.80.135]:37049: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-30 03:43:17 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:43178: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-30 03:43:34 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:42863: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 30 03:45:05 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, TLS: Connection closed, session=<PwYIFMNEBqpChJmG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 30 03:45:12 host2 dovecot[1796015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, session=<5vRtFMNENGhChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 03:45:33 host2 sshd[3245853]: Disconnected from invalid user 1234 2.57.121.112 port 62941 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-11-30 03:48:28 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:61715: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-11-30 03:48:36 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:43254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.89
country_id: 6252001
description:
2025-11-30 03:50:48 dovecot_login authenticator failed for (ADMIN) [158.173.25.89]:35546: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 03:54:42 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JgBGNsNEeqUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-30 03:56:16 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:46568: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-30 03:57:14 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:42112: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 03:57:16 host2 sshd[3253905]: Disconnected from invalid user  2.57.121.112 port 63072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-30 03:57:37 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:47154: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 03:58:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HB6TRcNE5qsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.80
country_id: 660013
description:
2025-11-30 04:04:54 dovecot_login authenticator failed for (ADMIN) [188.126.89.80]:11733: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 04:04:46 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=</e5MWsNEwwpRvaKO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 30 04:15:18 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<F1/yf8NEQJOSOC+J>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.238
country_id: 6252001
description:
Nov 30 04:17:05 host2 pure-ftpd[3269636]: (?@205.210.31.238) [INFO] New connection from 205.210.31.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-30 04:18:00 dovecot_login authenticator failed for (visaotur.sdr.gvt.net.br) [186.215.245.175]:44136: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-11-30 04:18:11 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:45608: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.243
country_id: 798544
description:
2025-11-30 04:19:21 dovecot_login authenticator failed for (ADMIN) [138.199.59.243]:40620: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-30 04:19:59 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:58586: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-30 04:20:49 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:36538: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-11-30 04:25:07 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:55261: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-30 04:25:29 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:59618: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.254
country_id: 1733045
description:
2025-11-30 04:25:36 dovecot_login authenticator failed for ([49.124.150.254]) [49.124.150.254]:38458: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-30 04:26:44 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:59826: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.247.109
country_id: 953987
description:
2025-11-30 04:26:54 dovecot_login authenticator failed for ([41.78.247.109]) [41.78.247.109]:38530: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.42
country_id: 6251999
description:
Nov 30 04:28:23 host2 dovecot[1796015]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.42, lip=66.85.158.92, session=<ZybersNEEoZWNh8q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.132.232.14
country_id: 1733045
description:
Nov 30 04:28:33 host2 sshd[3281821]: Disconnected from invalid user luis 115.132.232.14 port 42697 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Nov 30 04:29:31 host2 sshd[3282642]: Disconnected from invalid user weblogic 45.78.231.192 port 44650 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.49.226.111
country_id: 2750405
description:
[2025-11-30 04:32:49 +0530] info [webmaild] 37.49.226.111 - host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user host2.phenomhost.com (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Nov 30 04:32:55 host2 sshd[3285438]: Disconnected from invalid user tony 45.78.231.192 port 53900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.132.232.14
country_id: 1733045
description:
Nov 30 04:32:57 host2 sshd[3285465]: Disconnected from invalid user vbox 115.132.232.14 port 53922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.132.232.14
country_id: 1733045
description:
Nov 30 04:34:17 host2 sshd[3286374]: Disconnected from invalid user testuser 115.132.232.14 port 40934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.191.255.182
country_id: 1694008
description:
2025-11-30 04:34:23 dovecot_plain authenticator failed for (10I184C09IJ1) [180.191.255.182]:50435: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.42
country_id: 953987
description:
2025-11-30 04:34:49 dovecot_login authenticator failed for (ADMIN) [154.47.30.42]:10030: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.132.232.14
country_id: 1733045
description:
Nov 30 04:36:58 host2 sshd[3290725]: Disconnected from invalid user superman 115.132.232.14 port 43198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-30 04:37:11 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:59678: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.12
country_id: 2264397
description:
Nov 30 04:37:42 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.226.197.12, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZH4z0MNExpi54sUM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.13
country_id: 2264397
description:
Nov 30 04:37:42 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.13, lip=66.85.158.92, TLS, session=<Em0s0MNE5cm54sUN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.15
country_id: 2264397
description:
Nov 30 04:37:43 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.15, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Zak+0MNEccC54sUP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.13
country_id: 2264397
description:
Nov 30 04:37:43 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.226.197.13, lip=66.85.158.92, TLS, session=<0Co70MNEudG54sUN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.14
country_id: 2264397
description:
Nov 30 04:37:44 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.14, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<tNNU0MNEu5q54sUO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.209.44.9
country_id: 2661886
description:
2025-11-30 04:37:28 dovecot_login authenticator failed for 217-209-44-9-no600.tbcn.telia.com [217.209.44.9]:57682: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.132.232.14
country_id: 1733045
description:
Nov 30 04:38:17 host2 sshd[3291321]: Disconnected from invalid user qiyuesuo 115.132.232.14 port 58444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-11-30 04:48:03 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:54125: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-11-30 04:47:48 dovecot_login authenticator failed for ([128.185.223.185]) [27.123.114.190]:52192: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-11-30 04:49:50 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:45296: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.175
country_id: 3175395
description:
Nov 30 04:50:10 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 43 secs): user=<contact>, method=PLAIN, rip=185.15.171.175, lip=66.85.158.91, TLS, session=<WtE5+sNElY65D6uv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.250.102.115
country_id: 3469034
description:
Nov 30 04:49:14 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.250.102.115, lip=66.85.158.91, TLS, session=<rblz98NE/9Sn+mZz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-30 04:49:33 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:36056: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.105.72
country_id: 6252001
description:
Nov 30 04:51:11 host2 pure-ftpd[3298773]: (?@20.169.105.72) [INFO] New connection from 20.169.105.72


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.231.192
country_id: 1880251
description:
Nov 30 04:51:55 host2 sshd[3299156]: Disconnected from invalid user hb 45.78.231.192 port 49522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.70
country_id: 783754
description:
2025-11-30 04:52:58 dovecot_login authenticator failed for (ADMIN) [31.171.154.70]:41918: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-30 04:53:08 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:52970: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 57.151.105.130
country_id: 6252001
description:
Nov 30 04:56:21 host2 pure-ftpd[3302291]: (?@57.151.105.130) [INFO] New connection from 57.151.105.130


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 30 05:02:50 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<x2UVKsREOLhChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-11-30 05:03:12 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:41080: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-11-30 05:03:26 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:33388: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 05:04:54 host2 sshd[3307707]: Disconnected from invalid user admin 2.57.121.112 port 25109 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 05:08:00 host2 sshd[3309783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.245.198.163
country_id: 2963597
description:
Denial of Service (DoS) attack was discovered from 34.245.198.163: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-11-30 05:14:42 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:53015: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-30 05:15:02 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:33450: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Nov 30 05:15:02 host2 dovecot[1796015]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS, session=<ZwyzVcREaOlHBobr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 05:16:30 host2 sshd[3315339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.160
country_id: 2635167
description:
2025-11-30 05:26:20 dovecot_login authenticator failed for (ADMIN) [158.173.23.160]:55064: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 05:30:59 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Xn2ejsREmeVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-30 05:34:11 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:45869: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-30 05:36:11 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59708: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-30 05:36:31 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:45908: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-30 05:38:49 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:57780: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.58
country_id: 798544
description:
2025-11-30 05:39:47 dovecot_login authenticator failed for (ADMIN) [138.199.59.58]:33644: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Nov 30 05:39:54 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.242, lip=66.85.158.91, TLS, session=<3e+drsREfPzG6xjy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 30 05:40:27 host2 sshd[3329279]: Disconnected from invalid user magento 20.88.55.220 port 46942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 30 05:44:02 host2 sshd[3331097]: Disconnected from invalid user share 20.88.55.220 port 47282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 30 05:46:30 host2 sshd[3333140]: Disconnected from invalid user ftptest 20.88.55.220 port 47540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 30 05:47:52 host2 sshd[3333772]: Disconnected from invalid user frappe 20.88.55.220 port 47674 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.180.168
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.50.180.168 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 30 05:50:53 host2 sshd[3335375]: Disconnected from invalid user samba 20.88.55.220 port 47930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-11-30 05:53:48 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:51986: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-30 05:56:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56262: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Nov 30 05:59:58 host2 dovecot[1796015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<72Nq9sREudbG6xh7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-30 05:59:52 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:42156: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-30 06:00:24 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:39218: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.11
country_id: 2589581
description:
2025-11-30 06:03:04 dovecot_login authenticator failed for (ADMIN) [176.125.228.11]:13917: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-30 06:11:56 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:55994: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-11-30 06:12:38 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54822: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.128.234.37
country_id: 3017382
description:
2025-11-30 06:15:13 dovecot_login authenticator failed for 37.234.128.77.rev.sfr.net [77.128.234.37]:37264: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.12
country_id: 2658434
description:
2025-11-30 06:21:16 dovecot_login authenticator failed for (ADMIN) [158.173.152.12]:59895: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-11-30 06:21:53 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:59914: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-30 06:22:03 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:58659: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.55.60.167
country_id: 6252001
description:
Nov 30 06:23:56 host2 dovecot[1796015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=69.55.60.167, lip=66.85.158.92, session=<Nb4bTMVEcpRFNzyn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 06:25:12 host2 sshd[3357453]: Disconnected from invalid user admin 2.57.121.112 port 33234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 06:26:45 host2 sshd[3358410]: Disconnected from invalid user yamile 62.60.131.157 port 57362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.72
country_id: 3017382
description:
2025-11-30 06:36:15 dovecot_login authenticator failed for (ADMIN) [203.188.183.72]:27906: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 8.221.138.135
country_id: 1861060
description:
Nov 30 06:39:50 host2 pure-ftpd[3365800]: (?@8.221.138.135) [INFO] New connection from 8.221.138.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 37.49.226.111 -  info@idesignvector.com  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-11-30 06:42:54 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:59496: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-30 06:43:26 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:45734: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-30 06:44:59 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:37508: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.17
country_id: 2186224
description:
2025-11-30 06:54:00 dovecot_login authenticator failed for (ADMIN) [179.61.240.17]:31097: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 06:59:30 host2 sshd[3377847]: Disconnected from invalid user username 2.57.121.112 port 62634 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Nov 30 07:03:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.91, TLS, session=<pnc92MVE7O3N0h/J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.197
country_id: 6252001
description:
Nov 30 07:06:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tn055MVEE8rG6xjF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 07:07:35 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<6P4U6MVERL0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.32
country_id: 6252001
description:
2025-11-30 07:08:50 dovecot_login authenticator failed for (ADMIN) [37.19.221.32]:38374: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 07:10:25 host2 sshd[3384699]: Disconnected from invalid user  2.57.121.112 port 62004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-30 07:18:12 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:44708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-30 07:18:22 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:49109: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-30 07:20:15 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:52635: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.39
country_id: 2264397
description:
2025-11-30 07:25:54 dovecot_login authenticator failed for (ADMIN) [146.70.59.39]:46684: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Nov 30 07:26:19 host2 sshd[3394722]: Disconnected from invalid user odoo 163.181.207.222 port 37742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 07:27:31 host2 sshd[3395285]: Disconnected from invalid user user 2.57.121.25 port 5723 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.181.207.222
country_id: 1605651
description:
Nov 30 07:29:19 host2 sshd[3396244]: Disconnected from invalid user test 163.181.207.222 port 54634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-30 07:31:48 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:56070: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-30 07:32:08 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:33586: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Nov 30 07:32:15 host2 sshd[3398260]: Disconnected from invalid user deploy 163.181.207.222 port 53428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2025-11-30 07:33:48 dovecot_login authenticator failed for 149.51.222.87.dynamic.jazztel.es [87.222.51.149]:34524: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.33.209
country_id: 1522867
description:
2025-11-30 07:33:55 dovecot_login authenticator failed for 2.135.33.209.dynamic.telecom.kz [2.135.33.209]:57796: 535 Incorrect authentication data (set_id=postmaster@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-11-30 07:33:59 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:37379: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-11-30 07:37:33 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:37873: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-30 07:41:38 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:58207: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-30 07:42:02 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:54179: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-30 07:46:37 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:49781: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.203
country_id: 6252001
description:
2025-11-30 07:58:16 dovecot_login authenticator failed for (ADMIN) [151.241.123.203]:36370: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.22.160.113
country_id: 3996063
description:
Nov 30 08:00:54 host2 sshd[3417029]: Disconnected from invalid user localhost 38.22.160.113 port 38986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Nov 30 08:05:43 host2 sshd[3420082]: Disconnected from invalid user user 160.174.129.232 port 46074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Nov 30 08:06:54 host2 sshd[3420684]: Disconnected from invalid user localhost 160.174.129.232 port 32980 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Nov 30 08:07:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.124, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<o5nevMZEK9LG6xh8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-30 08:07:21 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:40307: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-30 08:07:37 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:62062: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 08:07:47 host2 sshd[3421112]: Disconnected from invalid user admin 2.57.121.112 port 23047 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.22.160.113
country_id: 3996063
description:
Nov 30 08:08:45 host2 sshd[3421592]: Disconnected from invalid user shree 38.22.160.113 port 56496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Nov 30 08:09:17 host2 sshd[3421937]: Disconnected from invalid user manager 160.174.129.232 port 35015 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.22.160.113
country_id: 3996063
description:
Nov 30 08:09:52 host2 sshd[3422222]: Disconnected from invalid user mc 38.22.160.113 port 44978 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 08:11:47 host2 sshd[3423209]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-30 08:12:55 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:59120: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2025-11-30 08:13:13 dovecot_login authenticator failed for ([49.124.147.96]) [49.124.147.96]:58106: 535 Incorrect authentication data (set_id=monnierbenoitmichel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.217
country_id: 6252001
description:
2025-11-30 08:13:25 dovecot_login authenticator failed for (ADMIN) [102.129.153.217]:55654: 535 Incorrect authentication data (set_id=info@2s-travels.com)


