# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.220.203
country_id: 3865483
description:
2025-12-09 07:04:31 dovecot_plain authenticator failed for ([89.116.164.85]) [186.158.220.203]:21339: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.4.33.247
country_id: 3865483
description:
2025-12-09 07:04:45 dovecot_plain authenticator failed for host247.181-4-33.telecom.net.ar ([89.116.164.85]) [181.4.33.247]:38712: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 07:05:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<nUWU7XpFOL4v/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.231
country_id: 6252001
description:
Dec  9 07:06:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS: Connection closed, session=<4dFy8XpFaupHBobn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  9 07:09:06 host2 sshd[415492]: Disconnected from invalid user hadi 102.88.137.80 port 1295 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-09 07:08:55 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:44514: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-09 07:10:05 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:59335: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:09:13 host2 sshd[415633]: Disconnected from invalid user copia 8.210.49.167 port 41738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-09 07:09:17 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:59580: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:09:21 host2 sshd[415784]: Disconnected from invalid user frontend 172.174.72.225 port 57438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-12-09 07:09:52 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53466: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-09 07:10:14 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:37174: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-09 07:10:26 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:55562: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:12:05 host2 sshd[418739]: Disconnected from invalid user ftpuser 8.210.49.167 port 35258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:11:44 host2 sshd[418328]: Disconnected from invalid user info 45.249.247.165 port 36220 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.211
country_id: 2635167
description:
Dec  9 07:11:56 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.211, lip=66.85.158.91, TLS, session=<FeZRBHtFl8O594nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.65
country_id: 2635167
description:
Dec  9 07:11:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.65, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LRtlBHtFKeq594lB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.50
country_id: 2635167
description:
Dec  9 07:12:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.50, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</+xgBntF34G594ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec  9 07:13:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<tNNcCHtF/etX7LA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:12:18 host2 sshd[418963]: Disconnected from invalid user test 172.174.72.225 port 36202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Dec  9 07:13:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS, session=<vXtgCntFFvCTuYRG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.72
country_id: 2635167
description:
Dec  9 07:13:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.72, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<FIlYCntF8dFX7LBI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-09 07:13:41 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (deninge) [72.241.202.216]:42795: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:14:03 host2 sshd[420425]: Disconnected from invalid user test 8.219.165.224 port 51244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 07:14:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<3k8eDHtFgsqqQMFo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:13:32 host2 sshd[420040]: Disconnected from invalid user wxg 172.174.72.225 port 36484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.65
country_id: 2635167
description:
Dec  9 07:14:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.65, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<OVtODntFn95X7LBB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.49
country_id: 2635167
description:
Dec  9 07:14:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.49, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<RrRUDHtFs9hX7LAx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:14:48 host2 sshd[421040]: Disconnected from invalid user steam 8.210.49.167 port 34616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Dec  9 07:15:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x35IEntFe5lX7LAu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:16:06 host2 sshd[422759]: Disconnected from invalid user ubuntu 8.210.49.167 port 34282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:15:15 host2 sshd[421641]: Disconnected from invalid user wxg 47.236.24.117 port 38968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Dec  9 07:15:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JbRMEHtFXc+594kt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-09 07:16:23 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (lustor) [76.106.163.189]:35318: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:17:06 host2 sshd[424027]: Disconnected from invalid user hadi 8.219.165.224 port 33458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.43
country_id: 2635167
description:
Dec  9 07:16:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.43, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<YH9CFHtFR7a594kr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:16:37 host2 sshd[423429]: Disconnected from invalid user frontend 47.236.24.117 port 55550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.69
country_id: 2635167
description:
Dec  9 07:16:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.69, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<YOg+FntFoYS594lF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec  9 07:17:20 host2 sshd[424222]: Disconnected from invalid user pedrito 116.71.136.125 port 53474 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[53028] [Authentication Database]=[system] [Username]=[agro] (10/10 failures) (blocked until [Fri Nov 14 05:10:03 2025 UTC/Fri Nov 14 10:40:03 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:17:36 host2 sshd[424505]: Disconnected from invalid user httpd 45.249.247.165 port 60456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:17:45 host2 sshd[424652]: Disconnected from invalid user maman 8.219.165.224 port 51820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:18:13 host2 sshd[425180]: Disconnected from invalid user ubuntu 45.249.247.165 port 47270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:18:23 host2 sshd[425410]: Disconnected from invalid user sol 185.208.156.50 port 45392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:18:25 host2 sshd[425457]: Disconnected from invalid user frontend 8.219.165.224 port 39958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-09 07:18:46 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (unicas) [71.235.225.181]:46804: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:18:53 host2 sshd[426113]: Received disconnect from 185.208.156.50 port 55276:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-09 07:19:34 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (sampist) [73.161.96.107]:47984: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:19:21 host2 sshd[426736]: Disconnected from invalid user barcelona 47.236.24.117 port 49748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:19:24 host2 sshd[426808]: Disconnected from invalid user frontend 185.208.156.50 port 35084 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 07:21:09 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[53608] [Authentication Database]=[system] [Username]=[ajss] (10/10 failures) (blocked until [Fri Nov 14 05:10:03 2025 UTC/Fri Nov 14 10:40:03 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-09 07:21:43 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:52167: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-09 07:22:39 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:54458: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-12-09 07:23:08 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:48443: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-09 07:23:26 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:48782: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 07:23:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<9b1CLntF0tCnR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:23:44 host2 sshd[432542]: Disconnected from invalid user test 189.47.10.39 port 41728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-09 07:23:48 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:45694: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.25
country_id: 6252001
description:
2025-12-09 07:24:07 dovecot_login authenticator failed for ([72.214.133.25]) [72.214.133.25]:59472: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.250
country_id: 6252001
description:
2025-12-09 07:23:14 dovecot_login authenticator failed for wsip-184-191-242-250.fv.ks.cox.net [184.191.242.250]:38699: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 07:24:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<3jiHMXtFuKOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Dec  9 07:25:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<nVT8MXtFxdW/NYD9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.41
country_id: 798544
description:
Dec  9 07:25:19 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.247.41, lip=66.85.158.91, TLS, session=<histM3tFkd5tffcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 07:27:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<fLIkPHtF9KmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 07:27:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<qNMBPXtFQr68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-09 07:30:12 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:48356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-09 07:31:21 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:42580: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-09 07:31:42 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:47597: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:32:08 host2 sshd[442447]: Disconnected from invalid user mobile 189.47.10.39 port 37422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec  9 07:32:31 host2 sshd[442736]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 54080


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:34:04 host2 sshd[443927]: Disconnected from invalid user ubuntu 189.47.10.39 port 36020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 07:35:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<2feVV3tFwKRnJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.243.202
country_id: 660013
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 80.248.243.202 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:36:50 host2 sshd[447090]: Disconnected from invalid user frontend 189.47.10.39 port 38278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.160
country_id: 6290252
description:
Dec  9 07:40:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=109.207.35.160, lip=66.85.158.91, TLS, session=<ASVCa3tFzNZtzyOg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.142.185.16
country_id: 3469034
description:
Dec  9 07:41:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=200.142.185.16, lip=66.85.158.91, TLS, session=<z7BhbHtFjuPIjrkQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-09 07:46:37 dovecot_plain authenticator failed for (sperst) [105.72.176.66]:57832: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 07:46:40 dovecot_plain authenticator failed for (incess) [149.62.239.4]:45700: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 07:49:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gelosia) [87.103.126.54]:5560: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 07:49:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fViqi3tFfql100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.7
country_id: 2300660
description:
Dec  9 07:51:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.10.7, lip=66.85.158.91, TLS, session=<Ch23kXtFPIEpiwoH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.166.102
country_id: 3469034
description:
Dec  9 07:51:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.86.166.102, lip=66.85.158.91, TLS, session=<1SeAkHtFKcKxVqZm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.205.49
country_id: 2921044
description:
Dec  9 07:51:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.205.49, lip=66.85.158.92, TLS handshaking: Connection closed, session=<czmGkntFhPWhI80x>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  9 07:52:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<isaAlntFdPNChJl5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 07:53:12 host2 sshd[467151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.30.150
country_id: 226074
description:
Dec  9 07:53:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=196.0.30.150, lip=66.85.158.91, TLS, session=<M+yAmHtFHZzEAB6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.21
country_id: 3175395
description:
Dec  9 07:54:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.21, lip=66.85.158.91, TLS, session=<htzTmXtFAOC5D6sV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-09 07:53:21 dovecot_plain authenticator failed for (foophawlic) [5.76.44.40]:42732: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-09 07:54:45 dovecot_plain authenticator failed for (myines) [88.207.210.23]:61827: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 07:55:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Pf+KnntFqKIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 07:56:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kkXSo3tFyYB100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 07:57:53 host2 sshd[473888]: Disconnected from invalid user xq 8.218.69.102 port 47532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 07:58:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<FjCRqntFGOSqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 07:59:32 host2 sshd[475531]: Disconnected from invalid user user5 8.218.69.102 port 48730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-09 07:59:45 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:34344: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-09 07:59:27 dovecot_plain authenticator failed for (pirrant) [154.144.243.93]:43084: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-09 08:00:41 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:43166: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-09 08:00:58 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:51882: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 08:01:28 host2 sshd[478341]: Disconnected from invalid user ubuntu 8.218.69.102 port 33364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 08:02:10 host2 sshd[479009]: Disconnected from invalid user admin 2.57.121.112 port 25496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-12-09 08:02:20 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:55790: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-09 08:02:37 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:60388: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 08:02:44 host2 sshd[479753]: Disconnected from invalid user admin 8.218.69.102 port 60766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 08:03:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<D5UJvXtFOu4v/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:03:54 host2 sshd[481288]: Disconnected from invalid user ftp-user 27.111.32.174 port 36944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.16
country_id: 6252001
description:
Dec  9 08:04:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.16, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7nmZwXtF0ZDDuEwQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.112.45
country_id: 1819730
description:
Dec  9 08:04:24 host2 sshd[481895]: Disconnected from invalid user ubuntu 47.238.112.45 port 35722 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.86
country_id: 2635167
description:
Dec  9 08:04:36 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.86, lip=66.85.158.91, TLS, session=<4+y4wHtF26e594lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.23
country_id: 6252001
description:
Dec  9 08:04:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.23, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yIGmwHtFl9jDuEwX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.21
country_id: 6252001
description:
Dec  9 08:04:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=195.184.76.21, lip=66.85.158.92, TLS: Connection closed, session=<mgxcwXtFYcDDuEwV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.54
country_id: 1880251
description:
Dec  9 08:05:14 host2 sshd[483183]: Disconnected from invalid user testuser 47.236.43.54 port 57902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:05:47 host2 sshd[483960]: Disconnected from invalid user castle 27.111.32.174 port 39750 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.86.208
country_id: 2921044
description:
Dec  9 08:06:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.86.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7O3FxXtF5CeGelbQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:06:22 host2 sshd[484759]: Disconnected from invalid user httpd 27.111.32.174 port 56562 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 08:08:03 dovecot_plain authenticator failed for (hiessby) [5.11.140.219]:46836: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.63.198
country_id: 1269750
description:
Dec  9 08:07:34 host2 sshd[486199]: Disconnected from invalid user alex 223.181.63.198 port 12069 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 08:08:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lbAVz3tFOt9nJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-09 08:08:53 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:46567: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-09 08:09:07 dovecot_login authenticator failed for ([128.185.101.201]) [122.185.146.18]:40154: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.162
country_id: 6252001
description:
2025-12-09 08:09:07 dovecot_login authenticator failed for ([98.185.120.162]) [98.185.120.162]:36225: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 08:08:18 host2 sshd[486978]: Disconnected from invalid user user 2.57.121.25 port 37474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-09 08:09:17 dovecot_login authenticator failed for (nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:37772: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.29.127
country_id: 1880251
description:
Dec  9 08:09:57 host2 sshd[489107]: Disconnected from invalid user user 47.236.29.127 port 55092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:17:29 host2 sshd[499391]: Disconnected from invalid user deployer 8.219.49.164 port 47402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-12-09 08:16:51 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:41397: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-09 08:17:10 dovecot_plain authenticator failed for (amperne) [65.20.250.163]:44485: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-09 08:17:14 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35899: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:17:38 host2 sshd[499566]: Disconnected from invalid user vps 8.219.81.129 port 55434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.54
country_id: 1880251
description:
Dec  9 08:17:42 host2 sshd[499635]: Disconnected from invalid user oracle 47.236.43.54 port 50896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Dec  9 08:18:02 host2 sshd[500371]: Disconnected from invalid user user0 147.182.173.108 port 38494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.35.156
country_id: 6252001
description:
Dec  9 08:18:05 host2 sshd[500438]: Disconnected from invalid user deployer 209.141.35.156 port 16342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:18:11 host2 sshd[500555]: Disconnected from invalid user debian 8.219.49.164 port 37922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:18:14 host2 sshd[500627]: Disconnected from invalid user deployer 137.184.30.179 port 60864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Dec  9 08:17:31 host2 sshd[499444]: Disconnected from invalid user test 147.182.173.108 port 42962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:17:55 host2 sshd[500157]: Disconnected from invalid user deploy 149.102.135.204 port 48624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 08:18:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<iNfl83tF+OuPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2025-12-09 08:19:30 dovecot_login authenticator failed for ([49.124.159.179]) [49.124.159.179]:48970: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:19:05 host2 sshd[501571]: Disconnected from invalid user andy 8.213.215.66 port 44662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:18:50 host2 sshd[501244]: Disconnected from invalid user test123 8.219.49.164 port 60630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-09 08:19:03 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:42011: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:19:16 host2 sshd[501844]: Disconnected from invalid user andy 137.184.30.179 port 49184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:18:43 host2 sshd[501102]: Disconnected from invalid user test 137.184.30.179 port 36774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-09 08:19:24 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:53750: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:19:22 host2 sshd[501957]: Disconnected from invalid user admin 149.102.135.204 port 60688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-09 08:19:22 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:51142: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:20:05 host2 sshd[502983]: Disconnected from invalid user deployer 149.102.135.204 port 53144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-09 08:19:35 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:52322: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.115.138
country_id: 1880251
description:
Dec  9 08:19:37 host2 sshd[502286]: Disconnected from invalid user test123 47.237.115.138 port 55558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-09 08:19:40 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:43680: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:20:13 host2 sshd[503188]: Disconnected from invalid user deploy 137.184.30.179 port 43796 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-09 08:19:35 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:49437: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-09 08:19:49 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:59313: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-09 08:19:55 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:52752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:20:30 host2 sshd[503572]: Disconnected from invalid user user0 47.83.206.11 port 49854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec  9 08:19:44 host2 sshd[502392]: Disconnected from invalid user tableau 5.198.176.28 port 36870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:20:00 host2 sshd[502743]: Disconnected from invalid user deploy 8.213.215.66 port 44762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 08:20:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<pGVd+ntFKtOnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.101.85.160
country_id: 6252001
description:
2025-12-09 08:21:07 dovecot_plain authenticator failed for ([89.116.164.85]) [174.101.85.160]:43634: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.92.22.20
country_id: 3625428
description:
2025-12-09 08:21:19 dovecot_plain authenticator failed for ([89.116.164.85]) [38.92.22.20]:48988: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.156.24.229
country_id: 3996063
description:
2025-12-09 08:21:30 dovecot_plain authenticator failed for ([89.116.164.85]) [189.156.24.229]:49325: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec  9 08:21:31 host2 sshd[504678]: Disconnected from invalid user test 103.172.205.208 port 60434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:20:40 host2 sshd[503734]: Disconnected from invalid user st 8.219.49.164 port 32836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.121.82.86
country_id: 660013
description:
Dec  9 08:20:55 host2 sshd[504076]: Disconnected from invalid user admin 87.121.82.86 port 52554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 08:20:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<W5e++XtFmMaKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:21:32 host2 sshd[504693]: Disconnected from invalid user test 149.102.135.204 port 39964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.156.24.229
country_id: 3996063
description:
2025-12-09 08:21:36 dovecot_login authenticator failed for ([89.116.164.85]) [189.156.24.229]:49325: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:22:13 host2 sshd[505358]: Disconnected from invalid user vps 8.213.215.66 port 52384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 08:23:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<LCfJAnxFlry8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Dec  9 08:23:16 host2 sshd[506692]: Disconnected from invalid user ts3server 5.198.176.28 port 37180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 08:23:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<tGQ8BHxFesuKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:23:02 host2 sshd[506303]: Disconnected from invalid user test 47.83.206.11 port 50168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-09 08:24:15 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (dishia) [37.150.8.174]:46212: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.29.127
country_id: 1880251
description:
Dec  9 08:24:16 host2 sshd[507873]: Disconnected from invalid user danya 47.236.29.127 port 54328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:24:20 host2 sshd[507935]: Disconnected from invalid user httpd 47.83.206.11 port 45410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Dec  9 08:24:25 host2 sshd[507986]: Disconnected from invalid user mhd 103.217.145.104 port 55394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:24:28 host2 sshd[508054]: Disconnected from invalid user admin 8.219.81.129 port 36462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-09 08:24:09 dovecot_plain authenticator failed for (unsit) [5.76.44.40]:45302: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:25:13 host2 sshd[509036]: Disconnected from invalid user admin 8.213.215.66 port 44740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.233
country_id: 3996063
description:
2025-12-09 08:25:16 dovecot_login authenticator failed for ([201.173.196.233]) [201.173.196.233]:46447: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:26:29 host2 sshd[510549]: Disconnected from invalid user suporte 8.219.81.129 port 54166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-09 08:26:48 dovecot_plain authenticator failed for (probly) [64.72.74.162]:59821: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:27:27 host2 sshd[511710]: Disconnected from invalid user ubuntu 8.219.81.129 port 50756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.135.232.92
country_id: 2017370
description:
Dec  9 08:30:26 host2 sshd[515868]: Connection reset by invalid user user 45.135.232.92 port 20502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-09 08:31:20 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:40246: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-09 08:30:57 dovecot_login authenticator failed for ([125.19.162.102]) [125.19.162.102]:49326: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-09 08:31:46 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:60740: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 08:34:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<HmHXKXxFqIIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.23
country_id: 798544
description:
Dec  9 08:34:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.216.25.23, lip=66.85.158.91, TLS, session=<60+IKnxFAYWy2BkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.92
country_id: 3175395
description:
Dec  9 08:34:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.92, lip=66.85.158.91, TLS, session=<kaOLK3xFpKG5D6tc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 08:36:11 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:45644: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 08:36:09 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Dec  9 08:36:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.239, lip=66.85.158.92, session=<drIyMnxFVOvN0h/v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-09 08:36:33 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:46399: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec  9 08:36:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MFYbNHxFjv/CpRCl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 08:39:13 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[33342] [Authentication Database]=[system] [Username]=[ajsstarl] (10/10 failures) (blocked until [Wed Dec 10 03:09:13 2025 UTC/Wed Dec 10 08:39:13 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:40:11 host2 sshd[527707]: Disconnected from invalid user tableau 158.178.229.193 port 52638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 08:42:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<yOnlRnxFNKxnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-09 08:42:53 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:53012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-09 08:43:11 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:45111: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 08:44:13 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (picantra) [73.197.194.98]:59518: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-09 08:46:08 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:41138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-09 08:46:29 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:54615: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:45:33 host2 sshd[535203]: Disconnected from invalid user st 158.178.229.193 port 38048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.219.225
country_id: 6252001
description:
Dec  9 08:47:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.23.219.225, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gp2AWXxFbstAF9vh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:46:50 host2 sshd[538439]: Disconnected from invalid user test123 158.178.229.193 port 42064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:48:07 host2 sshd[540765]: Disconnected from invalid user dev 158.178.229.193 port 35152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.144.208.229
country_id: 2782113
description:
Dec  9 08:49:04 host2 sshd[541942]: Disconnected from invalid user centos 89.144.208.229 port 34657 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:49:22 host2 sshd[542333]: Disconnected from invalid user user0 158.178.229.193 port 55826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:49:32 host2 sshd[542573]: Disconnected from invalid user ubuntu 47.86.175.49 port 57546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 08:50:30 host2 sshd[544578]: Disconnected from invalid user ftpadmin1 152.42.231.101 port 44370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.226
country_id: 3017382
description:
Dec  9 08:51:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.226, lip=66.85.158.92, TLS handshaking: Connection closed, session=<e3AHZ3xFD5Nb51ni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.231
country_id: 3017382
description:
Dec  9 08:51:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.231, lip=66.85.158.92, TLS: Connection closed, session=<0DSoZ3xFl6Jb51nn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:51:20 host2 sshd[545718]: Disconnected from invalid user debian 47.236.43.76 port 46392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:51:29 host2 sshd[545954]: Disconnected from invalid user ubuntu 47.86.175.49 port 34732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.224
country_id: 3017382
description:
Dec  9 08:51:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.224, lip=66.85.158.92, TLS: Connection closed, session=<MQmdaHxFjdpb51ng>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec  9 08:52:53 host2 sshd[547370]: Disconnected from invalid user debian 203.145.34.173 port 43240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:52:48 host2 sshd[547315]: Disconnected from invalid user httpd 47.86.175.49 port 34046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:54:03 host2 sshd[548624]: Disconnected from invalid user alice 47.236.43.76 port 38322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:54:05 host2 sshd[548704]: Disconnected from invalid user puneet 47.86.175.49 port 33352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.144.208.229
country_id: 2782113
description:
Dec  9 08:53:44 host2 sshd[548247]: Disconnected from invalid user testuser 89.144.208.229 port 35716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 08:55:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<9P5rdXxFPYd100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:55:31 host2 sshd[550820]: Disconnected from invalid user cinema 47.236.43.76 port 40500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 08:54:32 host2 sshd[549449]: Disconnected from invalid user admin1234 152.42.231.101 port 55674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 08:54:36 host2 sshd[549522]: Disconnected from invalid user julian 151.57.124.197 port 18533 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Dec  9 08:54:39 host2 sshd[549583]: Disconnected from invalid user kyt 197.5.145.102 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec  9 08:58:47 host2 sshd[555236]: Disconnected from invalid user kkk 203.145.34.173 port 49200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.102
country_id: 2464461
description:
Dec  9 09:00:19 host2 sshd[557745]: Disconnected from invalid user ubuntu 197.5.145.102 port 55577 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:00:52 host2 sshd[558248]: Disconnected from invalid user rahul 62.60.234.135 port 45936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.214.242
country_id: 1733045
description:
2025-12-09 09:01:36 dovecot_plain authenticator failed for (56QUULLY) [60.48.214.242]:64815: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.214.242
country_id: 1733045
description:
2025-12-09 09:01:42 dovecot_login authenticator failed for (56QUULLY) [60.48.214.242]:64815: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-09 09:01:49 dovecot_plain authenticator failed for (inglocises) [50.217.255.171]:60647: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 09:01:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tWk0jXxFvqx100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 09:03:07 host2 sshd[561136]: Disconnected from invalid user httpd 152.42.231.101 port 47086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:02:54 host2 sshd[560766]: Disconnected from invalid user ubuntu 151.57.124.197 port 18769 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:03:42 host2 sshd[562340]: Disconnected from invalid user kafka 62.60.234.135 port 59020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 09:03:44 host2 sshd[562374]: Disconnected from invalid user jenkins 152.42.231.101 port 44378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:05:34 host2 sshd[564923]: Disconnected from invalid user httpd 62.60.234.135 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec  9 09:06:09 host2 sshd[565588]: Disconnected from invalid user mcserver 160.251.197.41 port 34252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:07:29 host2 sshd[567223]: Disconnected from invalid user ian 151.57.124.197 port 18066 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:07:55 host2 sshd[567451]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec  9 09:08:02 host2 sshd[567890]: Disconnected from invalid user kyt 160.251.197.41 port 41768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 09:07:52 host2 sshd[566088]: Connection reset by invalid user admin 2.57.121.112 port 24323 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.251
country_id: 6252001
description:
Dec  9 09:09:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.175.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x6faqHxF+r0ofK/7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.13
country_id: 2635167
description:
Dec  9 09:08:43 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.13, lip=66.85.158.92, TLS, session=<VJf9pXxFKbxX7LAN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.203
country_id: 2635167
description:
Dec  9 09:08:44 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.203, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9tEKpnxFdctX7LDL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Dec  9 09:09:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qhoGqHxF5YZX7LC4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:09:28 host2 sshd[569427]: Disconnected from invalid user user 151.57.124.197 port 18036 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.195
country_id: 2635167
description:
Dec  9 09:09:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.195, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<onwBqnxFs6tX7LDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-09 09:10:13 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:47126: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-09 09:10:12 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:57349: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-09 09:10:25 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:43191: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Dec  9 09:10:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<TtP8q3xFBcdX7LC6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-09 09:10:25 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:33664: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 09:11:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<PWkcrnxFSqSqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Dec  9 09:11:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oZTxr3xFjbJX7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.203
country_id: 2635167
description:
Dec  9 09:10:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.203, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<hhH4rXxFI7G594nL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.198
country_id: 2635167
description:
Dec  9 09:12:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.198, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NvPusXxFQ6hX7LDG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.189
country_id: 2635167
description:
Dec  9 09:12:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.189, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<L1Tqs3xF5cu594m9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 09:13:13 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (osity) [24.1.200.187]:56208: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec  9 09:13:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Wv7et3xFm9FX7LDV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-09 09:15:20 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:41798: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-09 09:15:34 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:44222: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.43
country_id: 6252001
description:
Dec  9 09:16:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YWcdwXxFfsMUQcIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 09:16:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<GUsfwnxFgouKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 09:17:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<paCBxHxFCNtnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-09 09:17:40 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (hancerchae) [73.137.7.97]:55392: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 09:19:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<X+qmynxFtoynR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 09:18:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<rzH7yXxFCqa8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 09:19:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<a2npzHxFyJKKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 09:21:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<vI+80nxFHIsf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 09:24:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<iRyi3HxFlsePbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-09 09:24:37 dovecot_plain authenticator failed for (manninded) [94.206.93.90]:57331: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-09 09:25:44 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:41669: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-09 09:26:05 dovecot_login authenticator failed for ([49.124.153.40]) [49.124.153.40]:39720: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-09 09:26:19 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:38272: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-09 09:26:32 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:41458: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:30:09 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.239.11.219
country_id: 617790
description:
Dec  9 09:30:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=91.239.11.219, lip=66.85.158.91, TLS, session=<kSfG8nxF0gtb7wvb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.57.100
country_id: 1269750
description:
Dec  9 09:30:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=103.237.57.100, lip=66.85.158.91, TLS, session=<9Orh83xFQdZn7Tlk>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.80.7.97
country_id: 1835841
description:
Dec  9 09:31:37 host2 sshd[601973]: Disconnected from invalid user httpd 47.80.7.97 port 34664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.140.17.124
country_id: 2017370
description:
Dec  9 09:31:51 host2 sshd[602265]: Connection reset by invalid user telecomadmin 45.140.17.124 port 60752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 09:33:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qkXW/HxFqocv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.2
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.2, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ArZy/XxFoOC5tI0C>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.3
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.3, lip=66.85.158.91, session=<9/Vv/XxFUem5tI0D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.4
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NC13/XxF6dS5tI0E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.3
country_id: 2264397
description:
Dec  9 09:33:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.180.141.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<4o2I/XxFHea5tI0D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 09:33:59 host2 sshd[606827]: Disconnected from invalid user user 2.57.121.25 port 39357 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-09 09:34:29 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:55378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-09 09:34:42 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:50080: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-09 09:37:42 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:7413: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-12-09 09:37:58 dovecot_login authenticator failed for ([63.65.203.86]) [63.65.203.86]:50379: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.46.239.237
country_id: 6252001
description:
2025-12-09 09:38:10 dovecot_plain authenticator failed for 99-46-239-237.lightspeed.stlsmo.sbcglobal.net ([89.116.164.85]) [99.46.239.237]:53712: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.220.20.35
country_id: 3865483
description:
2025-12-09 09:38:22 dovecot_plain authenticator failed for ([89.116.164.85]) [201.220.20.35]:33355: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.168.78
country_id: 1733045
description:
2025-12-09 09:38:36 dovecot_plain authenticator failed for ([89.116.164.85]) [60.48.168.78]:19541: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.168.78
country_id: 1733045
description:
2025-12-09 09:38:43 dovecot_login authenticator failed for ([89.116.164.85]) [60.48.168.78]:19541: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.115
country_id: 2300660
description:
Dec  9 09:40:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.139.44.115, lip=66.85.158.91, TLS, session=<Xq8AFX1Fm5spiyxz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.202
country_id: 3175395
description:
Dec  9 09:40:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.202, lip=66.85.158.91, TLS, session=<gbMpFn1FSsS5xQjK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  9 09:41:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<Y4GzG31F7ApChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-09 09:43:59 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (insucked) [73.27.33.174]:59458: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 09:49:42 host2 sshd[633530]: Disconnected from invalid user user 2.57.121.25 port 38615 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 09:51:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<jz2mP31F2NRnJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:51:54 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  9 09:53:06 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<Au+3RH1Fko258uIR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:55:22 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:56:13 host2 sshd[641612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-09 09:56:19 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:37909: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-09 09:56:31 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:51868: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 09:56:34 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:33538: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:57:36 host2 sshd[642918]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-09 09:56:41 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:59184: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 09:57:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<E1GtU31FnpiqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.100.197
country_id: 1269750
description:
2025-12-09 09:59:04 dovecot_plain authenticator failed for (Z69Q27X) [49.37.100.197]:50154: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  9 10:01:23 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<eSteYn1FiKG58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 10:02:15 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (ortrid) [73.208.81.125]:40842: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 10:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Ow5gbX1FsKwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 10:05:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 11 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<x1iWcH1FzaN100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.18
country_id: 6252001
description:
Dec  9 10:07:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SdnYdn1Fzrgs3LkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-09 10:08:57 dovecot_plain authenticator failed for (coffeshnis) [65.20.129.28]:45598: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-09 10:10:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (soplite) [98.227.25.115]:46186: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 10:11:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<V04oh31FGJCqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.103
country_id: 6252001
description:
Dec  9 10:13:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2N7djn1FcIcs3Lxn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 10:14:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<AADmkH1FNLiKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:15:11 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<2jGvk31FQLwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 10:15:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<alesk31FTru8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-12-09 10:15:24 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:38411: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 10:17:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gPQlmn1FbssXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:17:18 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<aXVJm31FbOEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 10:17:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<CefOm31FUsSKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:17:44 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<55vPnH1FyKMDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 10:19:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<sydeoX1FJp6Pbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-09 10:19:09 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:48720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<7Zveon1FgqkDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:27 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<BIfuon1FkKkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-09 10:19:40 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:59614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:49 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<AKZMpH1FAJ4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:21:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<wQy8qn1FAq0DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:21:39 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Cn3Nqn1FDq0DjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.60.230
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.245.60.230 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 10:23:46 dovecot_plain authenticator failed for (celed) [65.20.160.107]:34024: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.119
country_id: 3175395
description:
Dec  9 10:24:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.119, lip=66.85.158.91, TLS, session=<xf2Ksn1FAdC5D6t3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.197
country_id: 3469034
description:
Dec  9 10:24:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=187.120.104.197, lip=66.85.158.91, TLS, session=<0sa2s31FS467eGjF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 10:26:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<y+90un1FPsxnJFMP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:27:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QJ3Uv31FI9Yjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:28:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<g2WowX1FfPIjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:28:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=</UMHxH1FKvcjy9PB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-09 10:34:15 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:39056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  9 10:34:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<frAu2H1FVOZChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.21
country_id: 6252001
description:
2025-12-09 10:34:31 dovecot_login authenticator failed for ([98.185.120.21]) [98.185.120.21]:39839: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-09 10:33:47 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (bruggly) [217.215.74.195]:59747: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:36:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS, session=<uXwV4H1Fpukjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:37:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS, session=<NTa74n1FTuAjy9PB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 10:38:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62593: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  9 10:39:16 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<a33U6X1FWIOLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-09 10:39:47 dovecot_login authenticator failed for (201.173.216.196-clientes-izzi.mx) [201.173.216.196]:51896: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-09 10:40:02 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:34667: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 10:40:28 host2 sshd[687329]: Disconnected from invalid user admin 2.57.121.112 port 34258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  9 10:44:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2A2h/X1FOs8jy9Nz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 10:47:19 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-09 10:48:35 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (rampod) [68.83.181.181]:49998: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  9 10:51:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS, session=<tCqzFH5FPvIjy9Nz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.80.79
country_id: 1512440
description:
2025-12-09 10:55:45 dovecot_plain authenticator failed for ([89.116.164.85]) [84.54.80.79]:36639: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.237.1
country_id: 3865483
description:
2025-12-09 10:55:58 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.237.1]:50666: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.166.50.38
country_id: 3865483
description:
2025-12-09 10:56:11 dovecot_plain authenticator failed for ([89.116.164.85]) [181.166.50.38]:44829: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 10:56:13 host2 sshd[702415]: Connection reset by invalid user user 2.57.121.25 port 41180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 10:56:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<alAUJ35FmsSqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-09 10:58:39 dovecot_plain authenticator failed for (disese) [192.81.229.179]:42192: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-09 10:59:25 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:44174: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-12-09 10:59:28 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:55639: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-09 10:59:44 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:47447: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-09 10:59:48 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:38863: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 11:00:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<vS0FNH5FMKNnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-09 11:00:10 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:38448: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-09 11:00:18 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1119: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 11:02:52 dovecot_plain authenticator failed for (spiters) [149.62.239.4]:60850: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-09 11:02:57 dovecot_plain authenticator failed for (elegiang) [64.53.7.231]:55612: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-09 11:03:21 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:47642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 11:03:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 22 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+y2FP35FwWB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-09 11:03:41 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:55876: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:04:17 host2 sshd[709212]: Disconnected from invalid user es 160.174.129.232 port 45848 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:04:51 host2 sshd[709484]: Disconnected from invalid user wang 160.174.129.232 port 52939 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 11:05:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tXIgSH5FrIgv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:05:55 host2 sshd[710290]: Disconnected from invalid user debian 160.174.129.232 port 36153 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Dec  9 11:07:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.92, TLS: Connection closed, session=<jENbTX5F9MrHLZqT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:07:27 host2 sshd[711354]: Disconnected from invalid user web 47.237.139.198 port 42724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-09 11:08:02 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (undeusly) [73.13.220.220]:42774: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:08:28 host2 sshd[712075]: Disconnected from invalid user weblogic 45.78.205.117 port 41668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:08:34 host2 sshd[712171]: Disconnected from invalid user wang 47.237.139.198 port 51516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 11:09:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<b1kcVX5F+tKKxX03>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:36 host2 sshd[712154]: Disconnecting authenticating user root 82.67.140.251 port 57473: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:36 host2 sshd[712154]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 57473 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:45 host2 sshd[712287]: Disconnecting invalid user admin 82.67.140.251 port 58796: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 11:09:02 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 11:09:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<W6O6Vn5F02x100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 11:10:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<4E6tWH5FLMWqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 11:10:36 host2 sshd[714146]: Disconnected from invalid user user 2.57.121.25 port 10989 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 11:11:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<WTQ+W35F+Ke8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 11:12:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yeOJX35FCNWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:12:17 host2 sshd[715880]: Disconnected from invalid user ubuntu 47.237.139.198 port 44374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-09 11:12:33 dovecot_plain authenticator failed for (numbles) [62.73.121.209]:33631: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 11:12:35 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:21:29 host2 sshd[725059]: Disconnected from invalid user debian 45.78.205.117 port 52912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-09 11:21:49 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:53305: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 11:22:20 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:38874: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec  9 11:26:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<tvvWkn5FkjdChJl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec  9 11:28:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<MAzHmn5Faf/CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec  9 11:29:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MbbznH5F3v4t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:28:58 host2 sshd[732146]: Disconnected from invalid user test1 8.218.142.241 port 42342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:30:42 host2 sshd[733687]: Disconnected from invalid user xray 8.218.142.241 port 38030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:32:18 host2 sshd[735429]: Disconnected from invalid user peng 8.218.142.241 port 38520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:32:33 host2 sshd[735632]: Disconnected from invalid user devops 148.206.53.155 port 60370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:33:54 host2 sshd[736876]: Disconnected from invalid user ftpuser 47.239.243.11 port 44638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:35:23 host2 sshd[738070]: Disconnected from invalid user docker 45.78.205.117 port 51458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.119.47
country_id: 6252001
description:
Dec  9 11:38:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.119.47, lip=66.85.158.91, session=<Ox31u35FVJSGencv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:39:30 host2 sshd[741476]: Disconnected from invalid user httpd 47.239.243.11 port 41454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 11:38:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<GsUDv35Frugv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:40:38 host2 sshd[742497]: Disconnected from invalid user ivan 47.239.243.11 port 51484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:41:26 host2 sshd[743368]: Disconnected from invalid user bit 148.206.53.155 port 45670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:42:34 host2 sshd[744678]: Disconnected from invalid user dev 148.206.53.155 port 50958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:42:52 host2 sshd[744961]: Disconnected from invalid user edu 47.239.243.11 port 35160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-09 11:43:29 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (bitia) [174.166.153.20]:40902: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-09 11:44:13 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (rhari) [73.171.230.200]:38982: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 11:44:21 host2 sshd[746651]: Disconnected from invalid user admin 2.57.121.112 port 51489 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:44:54 host2 sshd[747208]: Disconnected from invalid user gts 47.237.149.81 port 54140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.54
country_id: 1819730
description:
Dec  9 11:45:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.54, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XdC+1n5Frsctjpo2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:47:13 host2 sshd[749918]: Disconnected from invalid user master 47.237.149.81 port 40960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.119.47
country_id: 6252001
description:
Dec  9 11:48:16 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.119.47, lip=66.85.158.92, session=<oPqW4H5FEuiGencv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 11:49:08 host2 sshd[751978]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:49:34 host2 sshd[752438]: Disconnected from invalid user kernel 47.237.149.81 port 57508 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 11:50:31 host2 sshd[753476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.81.154.199
country_id: 1269750
description:
Dec  9 11:50:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.81.154.199, lip=66.85.158.91, TLS, session=<Yl2i6H5F+6RnUZrH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.47
country_id: 953987
description:
Dec  9 11:51:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.32.47, lip=66.85.158.91, TLS, session=<ji/86X5F/sZmQCAv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 11:52:08 dovecot_plain authenticator failed for (segralle) [5.11.140.219]:50860: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 11:56:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<iVnT/H5FooSqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 11:57:47 host2 sshd[759799]: Disconnected from invalid user ubuntu 182.180.57.212 port 41348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-09 11:57:52 dovecot_plain authenticator failed for (natemphip) [65.20.143.159]:52097: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 11:58:05 host2 sshd[759994]: Disconnected from invalid user ubuntu 45.78.223.73 port 42964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 11:58:46 host2 sshd[760542]: Disconnected from invalid user amir 103.16.202.187 port 23804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 11:59:49 host2 sshd[761165]: Disconnected from invalid user web1 47.243.17.85 port 47220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:59:14 host2 sshd[760830]: Disconnected from invalid user botuser 47.237.149.81 port 44360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 11:59:31 host2 sshd[760973]: Disconnected from invalid user ubuntu 159.223.37.230 port 59958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Dec  9 12:00:28 host2 sshd[762078]: Disconnected from invalid user maha 103.193.178.214 port 56356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 12:00:34 host2 sshd[762168]: Disconnected from invalid user user1 47.243.17.85 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 12:00:36 host2 sshd[762158]: Disconnected from invalid user app 182.180.57.212 port 53964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 12:01:10 host2 sshd[762628]: Disconnected from invalid user vector 159.223.37.230 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:01:12 host2 sshd[762646]: Disconnected from invalid user testuser 103.16.202.187 port 16822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:02:39 host2 sshd[763931]: Disconnected from invalid user web1 103.16.202.187 port 50808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 12:02:40 host2 sshd[763942]: Disconnected from invalid user amir 47.243.17.85 port 42716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:02:43 host2 sshd[763996]: Disconnected from invalid user iptv 152.42.203.0 port 45582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-12-09 12:02:12 dovecot_login authenticator failed for ([2.55.70.26]) [2.55.70.26]:37408: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-12-09 12:02:21 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:57356: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-09 12:02:26 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:40798: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-09 12:02:01 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:50210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.254.5
country_id: 3996063
description:
2025-12-09 12:02:08 dovecot_login authenticator failed for ([189.219.254.5]) [189.219.254.5]:45922: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.233.123
country_id: 1522867
description:
2025-12-09 12:02:13 dovecot_login authenticator failed for 95.58.233.123.dynamic.telecom.kz [95.58.233.123]:50702: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 12:01:58 host2 sshd[763183]: Disconnected from invalid user systems 182.180.57.212 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:02:54 host2 sshd[764177]: Disconnected from invalid user retag 197.158.254.18 port 57256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:03:29 host2 sshd[765185]: Disconnected from invalid user nokia 152.42.203.0 port 56080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:03:35 host2 sshd[765273]: Disconnected from invalid user guest123 103.26.136.173 port 56102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Dec  9 12:04:15 host2 sshd[766058]: Disconnected from invalid user ya 103.193.178.214 port 52202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 12:04:21 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lious) [87.103.126.54]:53049: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:04:00 host2 sshd[765745]: Disconnected from invalid user mike 103.16.202.187 port 1110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:04:08 host2 sshd[765932]: Disconnected from invalid user ubuntu 152.42.203.0 port 57662 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:04:13 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:04:18 host2 sshd[766122]: Disconnected from invalid user debian 103.26.136.173 port 40190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 12:04:28 host2 sshd[766294]: Disconnected from invalid user nicole 159.223.37.230 port 45488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 12:05:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<LYlsHH9FGIiKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:05:10 host2 sshd[767155]: Disconnected from invalid user gitea 209.141.47.217 port 43512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 12:05:25 host2 sshd[767388]: Disconnected from invalid user nokia 45.78.223.73 port 41632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:05:38 host2 sshd[767642]: Disconnected from invalid user esuser 103.26.136.173 port 36600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 12:06:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<SfKeIX9Fw4h100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:06:53 host2 sshd[768904]: Disconnected from invalid user deploy 209.141.47.217 port 38868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 12:07:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<t5VGJH9F+M+8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.146
country_id: 1880251
description:
Dec  9 12:07:29 host2 sshd[769395]: Disconnected from invalid user bot 45.78.220.146 port 33018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:07:59 host2 sshd[769876]: Disconnected from invalid user guest123 209.141.47.217 port 50902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 12:08:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ao8bJ39FCo+KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.20.72.91
country_id: 3175395
description:
2025-12-09 12:08:07 dovecot_login authenticator failed for host-79-20-72-91.retail.telecomitalia.it [79.20.72.91]:56960: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-09 12:08:23 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:47362: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:08:31 host2 sshd[770700]: Disconnected from invalid user manager 34.58.124.191 port 37248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 12:07:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<O//aJn9FMt2Pbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:08:54 host2 sshd[771189]: Disconnected from invalid user lisong 197.158.254.18 port 57350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.137.122
country_id: 1880251
description:
Dec  9 12:10:12 host2 sshd[772746]: Disconnected from invalid user daniel 47.236.137.122 port 58196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 12:10:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Tvi1L39Feo+qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:09:54 host2 sshd[772251]: Disconnected from invalid user sales1 197.158.254.18 port 43246 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:10:01 host2 sshd[772348]: Received disconnect from 209.141.47.217 port 36424:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:10:01 host2 sshd[772348]: Disconnected from invalid user ahsan 209.141.47.217 port 36424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.137.122
country_id: 1880251
description:
Dec  9 12:11:45 host2 sshd[774423]: Disconnected from invalid user kserge 47.236.137.122 port 53682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:11:54 host2 sshd[774541]: Disconnected from invalid user httpd 197.158.254.18 port 43276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:12:21 host2 sshd[775014]: Disconnected from invalid user gpadmin 34.58.124.191 port 34462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:13:02 host2 sshd[775705]: Disconnected from invalid user git 34.58.124.191 port 38408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.168.28.250
country_id: 3351879
description:
2025-12-09 12:13:28 dovecot_plain authenticator failed for ([89.116.164.85]) [105.168.28.250]:40018: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.135.174.113
country_id: 192950
description:
2025-12-09 12:13:45 dovecot_plain authenticator failed for ([89.116.164.85]) [102.135.174.113]:54280: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 12:12:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tuPcOH9FIpB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.135.174.113
country_id: 192950
description:
2025-12-09 12:13:53 dovecot_login authenticator failed for ([89.116.164.85]) [102.135.174.113]:54280: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-09 12:13:56 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:64367: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.246.21.188
country_id: 3865483
description:
2025-12-09 12:14:00 dovecot_plain authenticator failed for ([89.116.164.85]) [170.246.21.188]:54116: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:14:15 host2 sshd[777063]: Disconnected from invalid user test3 34.58.124.191 port 34556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  9 12:15:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<y8eQQX9F+uJIPG+y>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.210.179.197
country_id: 3017382
description:
Dec  9 12:15:09 host2 sshd[778204]: Received disconnect from 51.210.179.197 port 57640:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-09 12:16:18 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:2091: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-09 12:16:19 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:34299: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 12:16:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Ggn9RX9Fqs4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-09 12:16:42 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:36490: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-09 12:16:49 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:56940: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-09 12:17:23 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (larle) [73.195.211.98]:60156: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Dec  9 12:17:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0CBwSX9Fk83G6xh2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.210.179.197
country_id: 3017382
description:
Dec  9 12:19:04 host2 sshd[781557]: Disconnected from invalid user stud1 51.210.179.197 port 41540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 12:19:38 host2 sshd[781987]: Disconnected from invalid user saeed 45.78.223.73 port 50378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-09 12:26:08 dovecot_plain authenticator failed for (oopardical) [94.201.22.158]:40828: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:26:40 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.151
country_id: 3175395
description:
Dec  9 12:27:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.68.178.151, lip=66.85.158.91, TLS, session=<JkAUa39FjJe5RLKX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.235
country_id: 3865483
description:
Dec  9 12:27:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.0.251.235, lip=66.85.158.91, TLS, session=<Mqc8bH9Fap6zAPvr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.79
country_id: 732800
description:
2025-12-09 12:28:05 dovecot_login authenticator failed for (test) [93.123.109.79]:50528: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:28:24 host2 sshd[790712]: Disconnected from invalid user app 47.243.255.121 port 55054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-09 12:29:40 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:47046: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:30:18 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:30:43 host2 sshd[793580]: Disconnected from invalid user test 47.243.255.121 port 41286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-12-09 12:29:58 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:38589: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:32:17 host2 sshd[795121]: Disconnected from invalid user user0 47.243.255.121 port 41530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 12:34:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<IP8xhn9FBJYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 12:35:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ra/6iX9FjNEDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.79
country_id: 732800
description:
2025-12-09 12:37:55 dovecot_login authenticator failed for (test) [93.123.109.79]:63140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 12:39:46 host2 sshd[802874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-09 12:40:33 dovecot_plain authenticator failed for (menre) [65.20.133.208]:53316: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 12:41:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MNN8n39FhNIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.59.215.13
country_id: 357994
description:
2025-12-09 12:42:37 dovecot_plain authenticator failed for (LF21D45A3WC8) [197.59.215.13]:53610: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.123.145
country_id: 3469034
description:
Dec  9 12:43:07 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=192.140.123.145, lip=66.85.158.91, TLS, session=<cwyqo39FOcPAjHuR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec  9 12:43:27 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<IXDZpH9FANjJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.234
country_id: 953987
description:
Dec  9 12:48:47 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.129.52.234, lip=66.85.158.91, TLS, session=<FU6Dt39FV5xmgTTq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.237.132
country_id: 3625428
description:
Dec  9 12:48:22 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.237.132, lip=66.85.158.91, session=<GRSOt39FBIVfte2E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.50
country_id: 99237
description:
Dec  9 12:49:06 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=65.20.205.50, lip=66.85.158.91, TLS, session=<UD8UuX9F+MJBFM0y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.132
country_id: 1643084
description:
Dec  9 12:53:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.201.132, lip=66.85.158.91, session=<8rY7yn9FIr6t78mE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.200
country_id: 2623032
description:
Dec  9 12:53:36 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.126.94.200, lip=66.85.158.91, session=<B1E3yn9FJqe8fl7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-09 12:54:10 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:37438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-09 12:54:43 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:60286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 12:56:50 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<8mmo1X9FULmqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-09 12:57:36 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:38928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-09 12:58:10 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:53831: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-09 13:00:20 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:41702: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-09 13:00:40 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:35101: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 13:00:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<4ZV3439F7ISKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.127
country_id: 6252001
description:
Dec  9 13:01:06 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.127, lip=66.85.158.91, TLS, session=<PmIJ5X9F4uvG6xh/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 13:03:34 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hKbA7X9FvIaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 13:02:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<lmA+639F8pGPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 13:04:12 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<J+gA8H9Feo28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 13:09:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<DAnHAYBFh0d100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-09 13:09:22 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:41151: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-09 13:09:41 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:55720: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 13:10:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Dr3hB4BFKNWqQMFo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec  9 13:12:37 host2 pure-ftpd[835204]: (?@185.247.137.92) [INFO] New connection from 185.247.137.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:17:24 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XfpWH4BFaLwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:18:38 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rw6+I4BF5p4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:18:55 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QFvMJIBFDrYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:20:57 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wWMGLIBF1r4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:22:10 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7h5iMIBF9qIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:23:25 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<WIHeNIBFTMgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:24:59 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<royAOoBF9tIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  9 13:25:04 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<T6jAOoBF8f7CpRCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:26:24 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CeiGP4BF6L4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-09 13:26:20 dovecot_plain authenticator failed for (subdois) [5.31.15.108]:57982: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:27:05 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZnQBQoBFVukDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:28:36 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<37hrR4BFQpwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-09 13:29:21 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:39698: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-09 13:29:36 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:43452: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-09 13:34:21 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (yulingned) [73.171.230.200]:45269: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 13:36:45 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vlpwZIBFhNYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.216
country_id: 6252001
description:
2025-12-09 13:36:57 dovecot_login authenticator failed for wsip-184-191-242-216.fv.ks.cox.net [184.191.242.216]:34746: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Dec  9 13:36:57 host2 pure-ftpd[856493]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-09 13:37:27 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:51968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 13:42:12 host2 sshd[861214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 13:43:35 host2 sshd[862294]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 13:46:31 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 13:48:28 host2 sshd[867296]: Disconnected from invalid user user 2.57.121.25 port 17064 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 13:50:16 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.241
country_id: 6252001
description:
2025-12-09 13:51:31 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:35253: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-09 13:51:47 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:46614: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 13:54:48 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<JEX+pIBFlKcf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 14:01:14 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<mSIFvIBFIIS8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.180.232
country_id: 2635167
description:
[2025-12-09 14:02:06 +0530] info [cpaneld] 209.50.180.232 - euroent3 "GET /login/?login_only=1&user=euroent3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.13.91
country_id: 6252001
description:
[2025-12-09 14:02:08 +0530] info [cpaneld] 65.111.13.91 - euroent5 "GET /login/?login_only=1&user=euroent5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.0.181
country_id: 6252001
description:
[2025-12-09 14:02:09 +0530] info [cpaneld] 65.111.0.181 - euroent6 "GET /login/?login_only=1&user=euroent6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent6 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.167.25.5
country_id: 6252001
description:
[2025-12-09 14:02:02 +0530] info [cpaneld] 104.167.25.5 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.53.132
country_id: 2635167
description:
[2025-12-09 14:02:12 +0530] info [cpaneld] 104.207.53.132 - euroen10 "GET /login/?login_only=1&user=euroen10&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen10 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.14.21
country_id: 6252001
description:
[2025-12-09 14:01:49 +0530] info [cpaneld] 65.111.14.21 - isuru "GET /login/?login_only=1&user=isuru&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user isuru (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.43.79
country_id: 2921044
description:
[2025-12-09 14:01:56 +0530] info [cpaneld] 45.3.43.79 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.162.124
country_id: 3017382
description:
[2025-12-09 14:02:02 +0530] info [cpaneld] 154.213.162.124 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.60
country_id: 2921044
description:
[2025-12-09 14:02:01 +0530] info [cpaneld] 65.111.24.60 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.9.209
country_id: 6252001
description:
[2025-12-09 14:02:05 +0530] info [cpaneld] 65.111.9.209 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.173.248
country_id: 6252001
description:
[2025-12-09 14:02:07 +0530] info [cpaneld] 209.50.173.248 - euroent4 "GET /login/?login_only=1&user=euroent4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.236.241
country_id: 6252001
description:
[2025-12-09 14:02:13 +0530] info [cpaneld] 216.26.236.241 - euroen11 "GET /login/?login_only=1&user=euroen11&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen11 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.51.162
country_id: 6252001
description:
[2025-12-09 14:01:55 +0530] info [cpaneld] 45.3.51.162 - euroentertain "GET /login/?login_only=1&user=euroentertain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.161.226
country_id: 6252001
description:
[2025-12-09 14:01:57 +0530] info [cpaneld] 209.50.161.226 - euroenterta "GET /login/?login_only=1&user=euroenterta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenterta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.38.125
country_id: 6252001
description:
[2025-12-09 14:02:00 +0530] info [cpaneld] 45.3.38.125 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.62.218
country_id: 3017382
description:
[2025-12-09 14:01:58 +0530] info [cpaneld] 104.207.62.218 - euroentert "GET /login/?login_only=1&user=euroentert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.255.155
country_id: 3017382
description:
[2025-12-09 14:01:59 +0530] info [cpaneld] 216.26.255.155 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.34.120
country_id: 6252001
description:
[2025-12-09 14:02:09 +0530] info [cpaneld] 104.207.34.120 - euroent7 "GET /login/?login_only=1&user=euroent7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.39.127
country_id: 6252001
description:
[2025-12-09 14:01:51 +0530] info [cpaneld] 104.207.39.127 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.34.162
country_id: 6252001
description:
[2025-12-09 14:01:52 +0530] info [cpaneld] 45.3.34.162 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.189.26
country_id: 3017382
description:
[2025-12-09 14:01:54 +0530] info [cpaneld] 209.50.189.26 - euroentertainm "GET /login/?login_only=1&user=euroentertainm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.41.42
country_id: 6252001
description:
[2025-12-09 14:01:59 +0530] info [cpaneld] 104.207.41.42 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.163
country_id: 2921044
description:
[2025-12-09 14:02:03 +0530] info [cpaneld] 65.111.24.163 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.56.97
country_id: 2921044
description:
[2025-12-09 14:02:04 +0530] info [cpaneld] 104.207.56.97 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.42.121
country_id: 2635167
description:
[2025-12-09 14:02:05 +0530] info [cpaneld] 45.3.42.121 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.25.101
country_id: 2921044
description:
[2025-12-09 14:02:11 +0530] info [cpaneld] 65.111.25.101 - euroent9 "GET /login/?login_only=1&user=euroent9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.167.19.66
country_id: 6252001
description:
[2025-12-09 14:01:50 +0530] info [cpaneld] 104.167.19.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.51.135
country_id: 2635167
description:
[2025-12-09 14:01:53 +0530] info [cpaneld] 104.207.51.135 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec  9 14:02:06 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<VSc7v4BFxEpChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-09 14:02:24 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (besse) [73.88.196.91]:56286: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-09 14:02:34 dovecot_plain authenticator failed for (rater) [199.192.123.12]:49948: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 14:06:14 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (cidia) [73.208.81.125]:32774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.189.167.215
country_id: 3017382
description:
[2025-12-09 14:06:11 +0530] info [cpaneld] 5.189.167.215 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-09 14:08:03 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (desom) [69.142.126.37]:39466: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 14:11:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<RmjO4IBFHI6qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 14:16:38 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<B4gW84BF/o8v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 14:19:53 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xcqu/oBFwqx100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec  9 14:20:56 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.18, lip=66.85.158.92, TLS handshaking: Connection closed, session=<T7iNAoFFM7vDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Dec  9 14:21:06 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.20, lip=66.85.158.92, TLS: Connection closed, session=<OeYrA4FFL5zDuEwU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.21
country_id: 6252001
description:
Dec  9 14:21:19 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.21, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WT30A4FFm4vDuEwV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec  9 14:21:22 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.18, lip=66.85.158.92, TLS: Connection closed, session=<eyAjBIFFq9bDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.91
country_id: 6252001
description:
Dec  9 14:23:07 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.91, lip=66.85.158.91, session=<m21hCoFFbKEs3Llb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 14:24:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58339: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-09 14:24:39 dovecot_plain authenticator failed for (razon) [24.104.225.201]:45475: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.200
country_id: 3175395
description:
Dec  9 14:25:35 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.171.200, lip=66.85.158.91, TLS, session=<ZgIYEoFFktO5D6vI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:25:48 host2 sshd[898392]: Disconnected from invalid user john 103.172.154.255 port 59784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.37
country_id: 933860
description:
Dec  9 14:25:57 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.209.37, lip=66.85.158.91, TLS, session=<WtdUE4FFZasp2NEl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-09 14:27:04 dovecot_plain authenticator failed for (catrauple) [90.160.139.163]:42403: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:27:13 host2 sshd[899402]: Disconnected from invalid user admin 103.172.154.255 port 38636 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:28:11 host2 sshd[900048]: Received disconnect from 103.172.154.255 port 37076:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-09 14:27:51 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (frilly) [196.47.172.253]:40605: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:27:51 host2 sshd[899789]: Disconnected from invalid user botuser 103.172.154.255 port 59286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:28:34 host2 sshd[900346]: Disconnected from invalid user user4 103.172.154.255 port 41826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 14:30:32 host2 sshd[902586]: Disconnected from invalid user admin 2.57.121.112 port 20770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-09 14:33:20 dovecot_login authenticator failed for ([84.213.189.183]) [84.213.189.183]:51036: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-09 14:33:25 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:57076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-09 14:33:24 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:50670: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-09 14:33:54 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:54698: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-09 14:33:57 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:38962: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-09 14:34:04 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:54544: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 14:36:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<FIRBOoFF7s6Pbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 14:38:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (docaret) [87.103.126.54]:33836: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.152.155
country_id: 690791
description:
Dec  9 14:41:26 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.152.155, lip=66.85.158.91, TLS, session=<kSHhSoFFk7Yl3Zib>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.18.50
country_id: 3469034
description:
Dec  9 14:41:47 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=177.86.18.50, lip=66.85.158.91, TLS, session=<v6EFTIFFAKyxVhIy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 14:42:20 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-09 14:43:02 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (nomarmist) [174.169.224.27]:51270: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-09 14:45:57 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (laser) [73.145.107.251]:42126: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-09 14:46:12 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:53242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-09 14:46:35 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:49350: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 14:48:02 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (deffier) [24.1.200.187]:50598: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-09 14:48:27 dovecot_plain authenticator failed for (unizablega) [65.20.147.45]:43021: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 14:50:16 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3sFWa4FFUoEv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 14:51:25 dovecot_plain authenticator failed for (ligater) [102.53.15.17]:52417: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 14:51:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Bw+lb4FFUsaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.68
country_id: 3175395
description:
Dec  9 14:51:55 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.208.106.68, lip=66.85.158.91, TLS, session=<fkBtcIFFwsu50GpE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.47
country_id: 3175395
description:
Dec  9 14:52:13 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.178.47, lip=66.85.158.91, TLS, session=<miV6cYFF3Z7ZGrIv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 14:52:30 host2 sshd[921876]: Disconnected from invalid user user 2.57.121.25 port 39196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.253
country_id: 3469034
description:
Dec  9 14:54:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.189.205.253, lip=66.85.158.91, TLS, session=<4JKDeIFF95mzvc39>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 14:54:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<h69meoFF9M2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.255.183.114
country_id: 3865483
description:
Dec  9 14:54:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=131.255.183.114, lip=66.85.158.91, TLS, session=<5tHXeYFF87CD/7dy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-09 14:57:13 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:40022: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.211.60
country_id: 2077456
description:
2025-12-09 14:57:44 dovecot_login authenticator failed for ([123.209.211.60]) [123.209.211.60]:47528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-09 14:58:09 dovecot_plain authenticator failed for (parahenter) [87.121.76.190]:33311: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 14:59:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<mgR7i4FFDL28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 14:58:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<bhLpiIFFLsyqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 48.217.234.252
country_id: 6252001
description:
Dec  9 14:59:47 host2 sshd[928179]: Disconnected from invalid user httpd 48.217.234.252 port 43274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec  9 15:01:31 host2 sshd[930246]: Disconnected from invalid user db2admin 203.189.233.12 port 44992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.189.233.12
country_id: 1861060
description:
Dec  9 15:02:01 host2 sshd[930807]: Disconnected from invalid user csserver 203.189.233.12 port 42468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 48.217.234.252
country_id: 6252001
description:
Dec  9 15:02:13 host2 sshd[931033]: Disconnected from invalid user csserver 48.217.234.252 port 34480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 1861060
description:
Dec  9 15:03:05 host2 sshd[931885]: Disconnected from invalid user nikola 203.189.233.12 port 34374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.187.5.63
country_id: 130758
description:
2025-12-09 15:02:44 dovecot_plain authenticator failed for (bitighae) [2.187.5.63]:46620: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.114.15.238
country_id: 6252001
description:
Dec  9 15:02:48 host2 sshd[931582]: Disconnected from invalid user admin 136.114.15.238 port 47666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.27.20.230
country_id: 6252001
description:
Dec  9 15:03:00 host2 sshd[931736]: Disconnected from invalid user bitrix 34.27.20.230 port 53554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.114.15.238
country_id: 6252001
description:
Dec  9 15:04:05 host2 sshd[933045]: Disconnected from invalid user pula 136.114.15.238 port 34536 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 15:05:30 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-12-09 15:06:27 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:54060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 48.217.234.252
country_id: 6252001
description:
Dec  9 15:06:35 host2 sshd[935753]: Disconnected from invalid user ubuntu 48.217.234.252 port 39988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-09 15:06:43 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:57682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 48.217.234.252
country_id: 6252001
description:
Dec  9 15:08:03 host2 sshd[937198]: Disconnected from invalid user mj 48.217.234.252 port 56356 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 15:09:07 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.22.8.217
country_id: 3865483
description:
2025-12-09 15:10:24 dovecot_login authenticator failed for ([186.22.8.217]) [186.22.8.217]:43552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-09 15:10:33 dovecot_plain authenticator failed for (isequal) [92.62.243.174]:45826: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.182.210.26
country_id: 2264397
description:
2025-12-09 15:10:45 dovecot_login authenticator failed for ([168.182.210.26]) [168.182.210.26]:58864: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.27.20.230
country_id: 6252001
description:
Dec  9 15:11:06 host2 sshd[939966]: Disconnected from invalid user mj 34.27.20.230 port 40366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  9 15:11:59 host2 sshd[940615]: Disconnected from invalid user kafka 185.126.7.35 port 56732 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.27.20.230
country_id: 6252001
description:
Dec  9 15:12:43 host2 sshd[941226]: Disconnected from invalid user prom 34.27.20.230 port 59182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  9 15:13:10 host2 sshd[941764]: Disconnected from invalid user raju 185.126.7.35 port 39120 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 15:13:14 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<NUqEvYFFxr+qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  9 15:14:15 host2 sshd[942778]: Disconnected from invalid user username 185.126.7.35 port 33440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-09 15:13:35 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:35806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.218.138
country_id: 130758
description:
Dec  9 15:13:39 host2 sshd[942223]: Disconnected from invalid user httpd 62.60.218.138 port 52468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-09 15:13:53 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:37895: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.126.7.35
country_id: 130758
description:
Dec  9 15:15:54 host2 sshd[944964]: Disconnected from invalid user mattermost 185.126.7.35 port 40586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.218.138
country_id: 130758
description:
Dec  9 15:16:42 host2 sshd[945647]: Disconnected from invalid user kafka 62.60.218.138 port 43308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.17
country_id: 3017382
description:
Dec  9 15:17:56 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.17, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UjVlzoFF7d5bxJgR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.218.138
country_id: 130758
description:
Dec  9 15:18:06 host2 sshd[947246]: Disconnected from invalid user sasha 62.60.218.138 port 56776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.106
country_id: 3017382
description:
Dec  9 15:18:08 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.106, lip=66.85.158.92, TLS: Connection closed, session=<aMgbz4FFrexbxJhq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  9 15:18:12 host2 sshd[947386]: Disconnected from invalid user wangbo 185.126.7.35 port 51184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 15:17:18 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<POgLzIFFqep100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.23
country_id: 3017382
description:
Dec  9 15:18:30 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.23, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9Rxw0IFFab9bxJgX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.19
country_id: 3017382
description:
Dec  9 15:18:33 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.19, lip=66.85.158.92, TLS: Connection closed, session=<Xhqg0IFFv4JbxJgT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.72.68
country_id: 1605651
description:
Dec  9 15:19:07 host2 sshd[948874]: Disconnected from invalid user denis 49.229.72.68 port 46452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 15:24:00 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 17 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hkQf44FFwNJ100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Dec  9 15:25:42 host2 sshd[959047]: Disconnected from invalid user admin 43.245.97.82 port 49414 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-09 15:30:07 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (cowed) [24.98.45.238]:41606: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.160.180.247
country_id: 3057568
description:
2025-12-09 15:30:14 dovecot_plain authenticator failed for static-dsl-247.213-160-180.telecom.sk (fultyllats) [213.160.180.247]:34397: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-09 15:32:16 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3742: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 15:31:18 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<BO4V/oFFQICPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-12-09 15:32:13 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (repte) [5.185.233.251]:57932: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.1.44
country_id: 2077456
description:
2025-12-09 15:32:40 dovecot_login authenticator failed for ([120.157.1.44]) [120.157.1.44]:41328: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-09 15:33:06 dovecot_login authenticator failed for ([14.195.19.75]) [14.195.19.75]:56826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.39
country_id: 6252001
description:
Dec  9 15:33:26 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.39, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JqvZBYJFmMTG6xgn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-12-09 15:34:23 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:49343: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-09 15:34:55 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:45374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-09 15:35:09 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:53792: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 15:35:16 host2 sshd[970395]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-09 15:35:30 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:51200: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 15:36:39 host2 sshd[971910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec  9 15:38:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qzoVF4JFht9ChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-09 15:38:59 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:54250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-09 15:39:14 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:57834: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 15:39:31 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<efN4G4JFOtQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 15:40:42 dovecot_plain authenticator failed for (oxing) [65.20.160.107]:34498: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-09 15:43:45 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:42315: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-09 15:43:48 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:43736: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-09 15:43:51 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:45046: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.156.241
country_id: 294640
description:
2025-12-09 15:44:03 dovecot_login authenticator failed for ([80.250.156.241]) [80.250.156.241]:57488: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-12-09 15:44:08 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:58890: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-09 15:44:19 dovecot_login authenticator failed for (nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:43710: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 15:45:57 host2 sshd[982394]: Disconnected from invalid user admin 2.57.121.112 port 41127 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec  9 15:45:33 host2 sshd[981528]: Disconnected from invalid user httpd 43.245.97.82 port 33464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-09 15:48:00 dovecot_plain authenticator failed for (derioly) [90.160.139.163]:57305: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-09 15:47:20 dovecot_plain authenticator failed for (spang) [154.144.243.93]:38578: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 15:47:21 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<mDCCN4JFioeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-09 15:47:57 dovecot_plain authenticator failed for (pariurics) [91.72.153.110]:47477: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 15:50:23 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<S8FfQoJFnI2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 15:53:13 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=</6qCTIJFZJIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 15:57:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<4KASXYJF0rq8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-09 15:59:02 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:52974: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-09 15:59:10 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:43971: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 15:59:44 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (leoute) [87.103.126.54]:21327: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 16:01:01 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<h7VZaIJFFrCqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.14.5
country_id: 6252001
description:
Dec  9 16:01:43 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.33.14.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<H7gEa4JFFbgtIQ4F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.12
country_id: 1880251
description:
Dec  9 16:04:09 host2 sshd[1000329]: Disconnected from invalid user user 101.47.162.12 port 54826 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 16:05:09 host2 sshd[1001554]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.18.151
country_id: 2921044
description:
Dec  9 16:04:57 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=159.89.18.151, lip=66.85.158.92, session=<2iWKdoJFe26fWRKX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.162
country_id: 2921044
description:
Dec  9 16:04:57 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.91.162, lip=66.85.158.92, session=<ChaVdoJFrJtA4lui>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Dec  9 16:06:08 host2 sshd[1002438]: Disconnected from invalid user lisi 34.142.110.144 port 48540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Dec  9 16:06:38 host2 sshd[1002858]: Disconnected from invalid user zyx 34.142.110.144 port 32820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  9 16:06:41 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, session=<BCW9fIJFYutHBpK6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Dec  9 16:07:18 host2 sshd[1003492]: Disconnected from invalid user tester 146.158.162.24 port 33326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Dec  9 16:07:35 host2 sshd[1003731]: Disconnected from invalid user httpd 101.36.122.23 port 47376 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.158.162.24
country_id: 2510769
description:
Dec  9 16:07:54 host2 sshd[1003937]: Disconnected from invalid user cacti 146.158.162.24 port 37696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Dec  9 16:08:26 host2 sshd[1004326]: Disconnected from invalid user debug 146.158.162.24 port 50468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.23
country_id: 1819730
description:
Dec  9 16:10:47 host2 sshd[1006148]: Disconnected from invalid user ansadmin 101.36.122.23 port 35344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 16:11:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unessiond) [87.103.126.54]:9652: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 101.36.122.23
country_id: 1819730
description:
Dec  9 16:11:49 host2 sshd[1006916]: Received disconnect from 101.36.122.23 port 33432:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.12
country_id: 1880251
description:
Dec  9 16:16:29 host2 sshd[1010967]: Disconnected from invalid user rr 101.47.162.12 port 57332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec  9 16:18:05 host2 sshd[1012406]: Disconnected from invalid user ubuntu 154.70.102.114 port 57768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.130.99
country_id: 3175395
description:
Dec  9 16:19:22 host2 sshd[1013283]: Disconnected from invalid user admin 84.33.130.99 port 21529 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-09 16:19:35 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:51458: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-12-09 16:19:38 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:36972: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.11
country_id: 3996063
description:
2025-12-09 16:19:14 dovecot_login authenticator failed for (189.218.82.11-clientes-izzi.mx) [189.218.82.11]:39756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Dec  9 16:19:19 host2 sshd[1013260]: Disconnected from invalid user sam 94.182.15.94 port 46106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Dec  9 16:20:52 host2 sshd[1015114]: Disconnected from invalid user system 197.248.104.19 port 45592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec  9 16:22:17 host2 sshd[1016187]: Disconnected from invalid user root2 154.70.102.114 port 38134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec  9 16:22:19 host2 sshd[1016213]: Disconnected from invalid user user01 203.150.162.250 port 44324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec  9 16:22:39 host2 sshd[1016414]: Disconnected from invalid user oracle 199.195.248.191 port 50820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.130.99
country_id: 3175395
description:
Dec  9 16:22:47 host2 sshd[1016484]: Disconnected from invalid user rishabh 84.33.130.99 port 19191 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec  9 16:22:52 host2 sshd[1016531]: Disconnected from invalid user admin 154.70.102.114 port 50012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 16:23:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Sdabt4JFAMQXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Dec  9 16:23:29 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.92, TLS, session=<LFfbuIJFkJOsaAsi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.163.183
country_id: 1562822
description:
Dec  9 16:23:49 host2 sshd[1017158]: Disconnected from invalid user ubuntu 152.32.163.183 port 32908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Dec  9 16:22:51 host2 sshd[1016403]: Disconnected from invalid user cel 117.247.111.70 port 31149 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Dec  9 16:23:25 host2 sshd[1016891]: Disconnected from invalid user mk 117.247.111.70 port 41253 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Dec  9 16:24:18 host2 sshd[1017554]: Disconnected from invalid user ubuntu 45.164.39.253 port 49212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec  9 16:24:49 host2 sshd[1017861]: Disconnected from invalid user sysadmin 203.150.162.250 port 59266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.231.149
country_id: 3017382
description:
Dec  9 16:24:22 host2 sshd[1017593]: Disconnected from invalid user postgres 162.19.231.149 port 59682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec  9 16:24:34 host2 sshd[1017727]: Disconnected from invalid user sam 199.195.248.191 port 33494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.130.99
country_id: 3175395
description:
Dec  9 16:24:35 host2 sshd[1017733]: Disconnected from invalid user sales 84.33.130.99 port 20497 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.19
country_id: 192950
description:
Dec  9 16:24:37 host2 sshd[1017739]: Disconnected from invalid user tomcat7 197.248.104.19 port 49378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec  9 16:25:07 host2 sshd[1018192]: Disconnected from invalid user admin 199.195.248.191 port 46536 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.164.39.253
country_id: 3469034
description:
Dec  9 16:24:56 host2 sshd[1017916]: Disconnected from invalid user andrew 45.164.39.253 port 33722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec  9 16:25:31 host2 sshd[1018605]: Disconnected from invalid user dima 103.20.122.54 port 53070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 16:25:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=</AecwIJFwNgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.152
country_id: 953987
description:
Dec  9 16:25:43 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.129.59.152, lip=66.85.158.91, TLS, session=<W3anv4JFcKNmgTuY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec  9 16:25:20 host2 sshd[1018382]: Disconnected from invalid user grid 116.193.191.46 port 41256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec  9 16:26:12 host2 sshd[1019178]: Disconnected from invalid user macro 118.194.250.11 port 43278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec  9 16:26:17 host2 sshd[1019235]: Disconnected from invalid user sam 203.150.162.250 port 39800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.242.25
country_id: 3469034
description:
Dec  9 16:26:05 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.92.242.25, lip=66.85.158.91, TLS, session=<GnX3wIJFpNWxXPIZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec  9 16:26:25 host2 sshd[1019310]: Disconnected from invalid user rocky 103.20.122.54 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec  9 16:27:40 host2 sshd[1020091]: Disconnected from invalid user system 203.150.162.250 port 58202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.231.149
country_id: 3017382
description:
Dec  9 16:27:46 host2 sshd[1020141]: Disconnected from invalid user sales 162.19.231.149 port 44436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 16:26:58 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<GqI0xYJFNq+Pbvgo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.20.122.54
country_id: 1605651
description:
Dec  9 16:27:07 host2 sshd[1019734]: Disconnected from invalid user test 103.20.122.54 port 50748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec  9 16:28:20 host2 sshd[1020496]: Disconnected from invalid user postgres 203.150.162.250 port 54452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-09 16:28:27 dovecot_plain authenticator failed for (mychucks) [154.146.240.123]:57284: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec  9 16:27:54 host2 sshd[1020194]: Disconnected from invalid user app 103.118.114.22 port 58550 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.91.98.128
country_id: 3017382
description:
Dec  9 16:29:42 host2 sshd[1021306]: Received disconnect from 51.91.98.128 port 55612:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Dec  9 16:28:59 host2 sshd[1020826]: Disconnected from invalid user vpn 94.182.15.94 port 48984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Dec  9 16:29:11 host2 sshd[1020986]: Disconnected from invalid user ak 51.91.98.128 port 42826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec  9 16:30:20 host2 sshd[1022096]: Disconnected from invalid user sales 116.193.191.46 port 35910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec  9 16:30:26 host2 sshd[1022145]: Disconnected from invalid user sftpuser1 103.118.114.22 port 43366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec  9 16:30:28 host2 sshd[1022170]: Disconnected from invalid user httpd 103.49.239.184 port 45148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.231.149
country_id: 3017382
description:
Dec  9 16:29:54 host2 sshd[1021420]: Disconnected from invalid user sysadmin 162.19.231.149 port 51926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec  9 16:31:12 host2 sshd[1022696]: Disconnected from invalid user grid 103.49.239.184 port 37858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.134
country_id: 1880251
description:
Dec  9 16:32:16 host2 sshd[1023227]: Disconnected from invalid user dspace 45.78.205.134 port 42480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec  9 16:32:42 host2 sshd[1023518]: Disconnected from invalid user newuser 103.98.176.164 port 40582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.46
country_id: 1643084
description:
Dec  9 16:33:05 host2 sshd[1023806]: Disconnected from invalid user sysadmin 116.193.191.46 port 43058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec  9 16:33:30 host2 sshd[1024126]: Disconnected from invalid user wpyan 103.98.176.164 port 57350 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 16:34:06 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec  9 16:34:18 host2 sshd[1024961]: Disconnected from invalid user adminuser 103.98.176.164 port 41930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec  9 16:35:06 host2 sshd[1025674]: Disconnected from invalid user httpd 103.98.176.164 port 40036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Dec  9 16:35:41 host2 sshd[1026214]: Disconnected from invalid user hamza 154.113.10.113 port 33426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Dec  9 16:37:05 host2 sshd[1027333]: Disconnected from invalid user website 154.113.10.113 port 55688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Dec  9 16:37:11 host2 sshd[1027379]: Disconnected from invalid user sftpuser1 45.78.205.209 port 48632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-09 16:37:13 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (oxock) [98.204.134.124]:57526: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.134
country_id: 1880251
description:
Dec  9 16:37:27 host2 sshd[1027647]: Disconnected from invalid user pzuser 45.78.205.134 port 42774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.113.10.113
country_id: 2328926
description:
Dec  9 16:38:31 host2 sshd[1028606]: Disconnected from invalid user wpyan 154.113.10.113 port 34782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.134
country_id: 1880251
description:
Dec  9 16:38:46 host2 sshd[1028761]: Disconnected from invalid user httpd 45.78.205.134 port 47122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.185.138.89
country_id: 3658394
description:
2025-12-09 16:39:35 dovecot_plain authenticator failed for (6LCBR6) [138.185.138.89]:62828: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec  9 16:40:38 host2 sshd[1030598]: Disconnected from invalid user grid 107.175.89.172 port 33542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-09 16:40:42 dovecot_login authenticator failed for ([182.95.85.181]) [182.95.123.46]:42200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 16:41:12 host2 sshd[1031037]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.145
country_id: 298795
description:
Dec  9 16:41:39 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=95.0.171.145, lip=66.85.158.91, TLS, session=</UzS+IJFQuxfAKuR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-09 16:41:47 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:47436: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-12-09 16:41:26 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:20108: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.212
country_id: 3865483
description:
Dec  9 16:42:02 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=179.0.250.212, lip=66.85.158.91, TLS, session=<Gvb8+YJFF6SzAPrU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-09 16:42:07 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:40994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-09 16:41:51 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (unwiss) [85.225.19.144]:44475: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.114.56.148
country_id: 6251999
description:
Dec  9 16:42:52 host2 sshd[1032145]: Disconnected from invalid user ftpuser 167.114.56.148 port 39452 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.209
country_id: 1880251
description:
Dec  9 16:43:32 host2 sshd[1032666]: Disconnected from invalid user postgres 45.78.205.209 port 53510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec  9 16:43:37 host2 sshd[1032790]: Disconnected from invalid user aovalle 45.174.162.68 port 17168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.240.192.149
country_id: 3175395
description:
Dec  9 16:43:47 host2 sshd[1032953]: Disconnected from invalid user user002 95.240.192.149 port 50888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 16:44:19 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<NB45A4NFbtuKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.212.213
country_id: 3175395
description:
Dec  9 16:44:43 host2 sshd[1033839]: Disconnected from invalid user forge 79.32.212.213 port 58560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec  9 16:45:20 host2 sshd[1034810]: Disconnected from invalid user admin 45.174.162.68 port 9804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  9 16:46:08 host2 sshd[1035764]: Disconnected from invalid user fivem 152.32.206.160 port 57464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec  9 16:45:54 host2 sshd[1035522]: Disconnected from invalid user sysadmin 107.175.89.172 port 50208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.174.162.68
country_id: 3469034
description:
Dec  9 16:46:00 host2 sshd[1035588]: Disconnected from invalid user user002 45.174.162.68 port 8955 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.212.213
country_id: 3175395
description:
Dec  9 16:46:05 host2 sshd[1035730]: Disconnected from invalid user king 79.32.212.213 port 52638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Dec  9 16:47:07 host2 sshd[1036546]: Disconnected from invalid user r00t 103.176.79.139 port 51668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 16:47:22 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<XBckDoNF0OSKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.240.192.149
country_id: 3175395
description:
Dec  9 16:47:29 host2 sshd[1036932]: Disconnected from invalid user ftpuser 95.240.192.149 port 41264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 16:47:34 host2 sshd[1037025]: Disconnected from invalid user admin 2.57.121.112 port 49335 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.212.213
country_id: 3175395
description:
Dec  9 16:48:33 host2 sshd[1037964]: Disconnected from invalid user dev 79.32.212.213 port 33208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.240.192.149
country_id: 3175395
description:
Dec  9 16:48:39 host2 sshd[1038100]: Disconnected from invalid user gmodserver 95.240.192.149 port 35174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.240.192.149
country_id: 3175395
description:
Dec  9 16:48:04 host2 sshd[1037517]: Disconnected from invalid user user 95.240.192.149 port 40670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Dec  9 16:49:43 host2 sshd[1039061]: Disconnected from invalid user julio 200.46.125.168 port 51482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.114.56.148
country_id: 6251999
description:
Dec  9 16:48:56 host2 sshd[1038363]: Disconnected from invalid user luis 167.114.56.148 port 32942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.212.213
country_id: 3175395
description:
Dec  9 16:49:08 host2 sshd[1038613]: Disconnected from invalid user mc 79.32.212.213 port 49218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.174.162.68
country_id: 3469034
description:
Dec  9 16:49:40 host2 sshd[1039024]: Disconnected from invalid user profe 45.174.162.68 port 35465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.240.192.149
country_id: 3175395
description:
Dec  9 16:49:59 host2 sshd[1039217]: Disconnected from invalid user httpd 95.240.192.149 port 43544 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  9 16:50:22 host2 sshd[1039714]: Received disconnect from 152.32.206.160 port 48932:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 16:51:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dinne) [87.103.126.54]:45406: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Dec  9 16:50:54 host2 sshd[1040053]: Disconnected from invalid user luis 152.32.206.160 port 47392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.114.56.148
country_id: 6251999
description:
Dec  9 16:51:10 host2 sshd[1040306]: Disconnected from invalid user httpd 167.114.56.148 port 40100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.64
country_id: 3469034
description:
Dec  9 16:52:30 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=200.77.179.64, lip=66.85.158.91, TLS, session=<mUqYH4NFi+HITbNA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 16:52:45 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (fineyenoid) [73.208.81.125]:44028: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-09 16:52:09 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (uncethic) [24.15.216.41]:37754: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.31
country_id: 3865483
description:
Dec  9 16:52:11 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.1.219.31, lip=66.85.158.91, TLS, session=<dxFkHoNF/O26Adsf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-09 16:53:22 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:58214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-09 16:53:34 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:58602: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-09 16:53:48 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:64491: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-09 16:53:50 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:47536: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.67.199
country_id: 458258
description:
Dec  9 16:54:24 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=85.255.67.199, lip=66.85.158.91, TLS, session=<90VXJoNFOApV/0PH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.191
country_id: 732800
description:
Dec  9 16:54:44 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=185.255.212.191, lip=66.85.158.91, TLS, session=<wdN7J4NF8eW5/9S/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-09 16:56:48 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:34306: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.46.125.168
country_id: 3703430
description:
Dec  9 16:56:28 host2 sshd[1045425]: Disconnected from invalid user luis 200.46.125.168 port 45212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-09 16:56:38 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:38582: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 16:56:37 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<MmorL4NF8tO8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-09 16:56:45 dovecot_plain authenticator failed for (psera) [80.227.102.242]:59961: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Dec  9 16:57:10 host2 sshd[1046079]: Disconnected from invalid user r00t 200.46.125.168 port 31963 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Dec  9 16:58:17 host2 sshd[1047020]: Disconnected from invalid user postgres 103.176.79.139 port 42952 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec  9 16:57:54 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<527xM4NFktK4aYtE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.139
country_id: 1643084
description:
Dec  9 16:59:00 host2 sshd[1047517]: Disconnected from invalid user nodejs 103.176.79.139 port 55630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 16:59:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (superte) [87.103.126.54]:29270: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-09 17:02:29 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:51298: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-09 17:02:47 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:37372: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 17:03:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<rS2+R4NFIsaqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-09 17:05:33 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:36059: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.175
country_id: 1733045
description:
2025-12-09 17:08:09 dovecot_login authenticator failed for ([49.124.154.175]) [49.124.154.175]:38774: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.119.69
country_id: 1819730
description:
Dec  9 17:08:33 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.119.69, lip=66.85.158.92, session=<hTQBWoNFRItlJHdF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-09 17:08:44 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:50798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-09 17:09:08 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:36634: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-12-09 17:09:13 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:20617: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-09 17:09:34 dovecot_login authenticator failed for ([78.156.0.88]) [78.156.0.88]:58721: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-09 17:09:59 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:47674: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.39
country_id: 6252001
description:
2025-12-09 17:10:17 dovecot_login authenticator failed for ([98.181.46.39]) [98.181.46.39]:41294: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-09 17:17:30 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (fasses) [96.230.65.90]:52434: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 17:18:03 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Sa7he4NFNKOqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 17:21:22 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (prete) [73.208.81.125]:57560: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 17:23:01 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<PaKajYNFHMCPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 17:24:14 host2 sshd[1070539]: Disconnected from invalid user user 2.57.121.25 port 13526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-09 17:26:31 dovecot_plain authenticator failed for (unred) [65.20.133.208]:50609: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 17:27:35 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<TG7vnYNFEJQv/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 17:28:34 host2 sshd[1073995]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 17:29:57 host2 sshd[1075078]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-09 17:30:02 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:50819: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.36
country_id: 3996063
description:
2025-12-09 17:30:30 dovecot_login authenticator failed for (189.219.138.36-clientes-izzi.mx) [189.219.138.36]:44948: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-12-09 17:31:08 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:54440: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-09 17:31:42 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:43326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 17:30:52 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (meted) [87.103.126.54]:41716: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-12-09 17:30:57 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:56646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-09 17:33:51 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (cacting) [73.197.236.163]:55024: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 17:37:31 host2 sshd[1080536]: Disconnected from invalid user user 2.57.121.25 port 39958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2025-12-09 17:39:23 dovecot_login authenticator failed for ([49.125.201.75]) [49.125.201.75]:59518: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-12-09 17:39:50 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:35352: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 17:40:44 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<PekBzYNFfMiKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 101.36.106.134
country_id: 1819730
description:
Dec  9 17:43:05 host2 dovecot[802051]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.106.134, lip=66.85.158.91, TLS, session=<cKWC1YNF3NBlJGqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.106.134
country_id: 1819730
description:
Dec  9 17:43:04 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.106.134, lip=66.85.158.91, session=<fYh11YNFmM9lJGqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 17:43:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<mNuK14NFJM6KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 17:44:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sosters) [87.103.126.54]:53226: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-09 17:47:41 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:39004: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-09 17:47:42 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:35149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-09 17:47:54 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:29917: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-09 17:48:02 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:50292: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-09 17:49:37 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:36752: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-09 17:49:49 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:48825: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 17:55:37 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<CiIKAoRFiuW8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 17:56:33 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<bkOKBYRFGIYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-09 17:57:22 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:48770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-09 17:57:48 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:47224: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-09 17:58:11 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:49006: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-09 17:58:17 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:51220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-09 17:59:11 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:58432: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 18:00:45 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 18:01:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<RW5bFoRFTJov/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.62.213.143
country_id: 3469034
description:
2025-12-09 18:01:50 dovecot_plain authenticator failed for ([89.116.164.85]) [177.62.213.143]:37965: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 18:02:05 host2 sshd[1101382]: Disconnected from invalid user admin 2.57.121.112 port 55224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.141.21.211
country_id: 6252001
description:
2025-12-09 18:02:14 dovecot_plain authenticator failed for 47-141-21-211.fdr01.pers.ca.frontiernet.net ([89.116.164.85]) [47.141.21.211]:44752: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 18:02:30 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SoTYGoRF/p2qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Dec  9 18:02:42 host2 sshd[1101770]: Disconnected from invalid user loginuser 89.47.53.19 port 37008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.62.213.143
country_id: 3469034
description:
2025-12-09 18:01:57 dovecot_login authenticator failed for ([89.116.164.85]) [177.62.213.143]:37965: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.253.31.51
country_id: 248816
description:
2025-12-09 18:02:03 dovecot_plain authenticator failed for ([89.116.164.85]) [92.253.31.51]:29474: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Dec  9 18:04:48 host2 sshd[1103652]: Disconnected from invalid user bodega 89.47.53.19 port 43942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec  9 18:04:20 host2 sshd[1103392]: Disconnected from invalid user gabriel 102.220.23.233 port 49804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Dec  9 18:05:23 host2 sshd[1104333]: Disconnected from invalid user xiwen 89.47.53.19 port 56574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec  9 18:06:07 host2 sshd[1104827]: Disconnected from invalid user httpd 38.47.94.55 port 55190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.105.137.206
country_id: 3469034
description:
2025-12-09 18:06:10 dovecot_plain authenticator failed for 189-105-137-206.user3p.vtal.net.br ([89.116.164.85]) [189.105.137.206]:38286: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.102.155.104
country_id: 3469034
description:
2025-12-09 18:06:24 dovecot_plain authenticator failed for 200-102-155-104.user3p.v-tal.net.br ([89.116.164.85]) [200.102.155.104]:60322: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.34.61.160
country_id: 1522867
description:
2025-12-09 18:06:38 dovecot_plain authenticator failed for ([89.116.164.85]) [5.34.61.160]:47486: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.233
country_id: 192950
description:
Dec  9 18:07:29 host2 sshd[1105810]: Disconnected from invalid user alex 102.220.23.233 port 51466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec  9 18:07:32 host2 sshd[1105813]: Disconnected from invalid user debian 38.47.94.55 port 38224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.233
country_id: 192950
description:
Dec  9 18:08:14 host2 sshd[1106433]: Disconnected from invalid user hadoop 102.220.23.233 port 37764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec  9 18:08:55 host2 sshd[1107011]: Disconnected from invalid user odoo 38.47.94.55 port 57018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec  9 18:09:42 host2 sshd[1107651]: Disconnected from invalid user httpd 118.193.61.170 port 58148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Dec  9 18:09:55 host2 sshd[1107775]: Disconnected from invalid user loginuser 20.196.64.198 port 47190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec  9 18:10:50 host2 sshd[1108755]: Disconnected from invalid user gabriel 118.194.230.250 port 59774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Dec  9 18:11:02 host2 sshd[1108819]: Disconnected from invalid user dylan 38.47.94.55 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec  9 18:11:34 host2 sshd[1109228]: Disconnected from invalid user webuser 118.194.230.250 port 59838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.13.244.219
country_id: 3686110
description:
Dec  9 18:11:53 host2 sshd[1109432]: Disconnected from invalid user xiwen 200.13.244.219 port 55764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec  9 18:12:15 host2 sshd[1109733]: Disconnected from invalid user webuser 118.193.61.170 port 50266 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:17:14 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<Z/OmT4RFPI0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:18:26 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<qGbzU4RF9IwDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.196.64.198
country_id: 1835841
description:
Dec  9 18:18:23 host2 sshd[1116132]: Disconnected from invalid user gabriel 20.196.64.198 port 40830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-09 18:18:33 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:57937: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:18:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<w32OVIRFTqkDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.131.235
country_id: 2661886
description:
2025-12-09 18:18:45 dovecot_login authenticator failed for c188-149-131-235.bredband.tele2.se [188.149.131.235]:40042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 18:19:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<ziR2VoRFrt+Pbvgo>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:19:52 host2 dovecot[802051]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<9K4WWYRFcoADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:19:55 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<LgxAWYRF6IYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:21:09 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<trifXYRFhMQDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:21:11 host2 dovecot[802051]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<QA7DXYRFFsIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Dec  9 18:22:26 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eDg9YoRFTpYDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  9 18:22:28 host2 sshd[1120022]: Disconnected from invalid user ftpmedia 198.12.114.232 port 41468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-09 18:23:19 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (epesse) [76.16.7.82]:35094: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.100.19
country_id: 1819730
description:
Dec  9 18:24:05 host2 sshd[1121238]: Invalid user cloudtourssrilan_travel from 196.251.100.19 port 56971


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.44.15.210
country_id: 357994
description:
Dec  9 18:24:12 host2 sshd[1121521]: Disconnected from invalid user ts3server 197.44.15.210 port 49562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.137.61
country_id: 1880251
description:
Dec  9 18:23:36 host2 sshd[1120927]: Disconnected from invalid user vikas 15.235.137.61 port 50820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.233
country_id: 1605651
description:
2025-12-09 18:25:06 dovecot_login authenticator failed for ([110.49.145.233]) [110.49.145.233]:40360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-09 18:25:12 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:60222: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.98.58.236
country_id: 6251999
description:
Dec  9 18:25:13 host2 sshd[1122643]: Disconnected from invalid user dspace 3.98.58.236 port 33348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-09 18:24:53 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:43743: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec  9 18:26:14 host2 sshd[1123563]: Disconnected from invalid user httpd 196.204.240.61 port 47696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.33
country_id: 6252001
description:
2025-12-09 18:26:30 dovecot_login authenticator failed for ([98.181.46.33]) [98.181.46.33]:54794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 18:26:32 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (aboble) [24.1.200.187]:56816: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  9 18:25:42 host2 sshd[1123063]: Disconnected from invalid user warango 198.12.114.232 port 34270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.11.149.198
country_id: 6251999
description:
2025-12-09 18:25:53 dovecot_login authenticator failed for ([72.11.149.198]) [72.11.149.198]:51708: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.97.9
country_id: 3469034
description:
Dec  9 18:26:34 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.240.97.9, lip=66.85.158.91, TLS, session=<neXtb4RFFI2/8GEJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.44.15.210
country_id: 357994
description:
Dec  9 18:26:38 host2 sshd[1123855]: Disconnected from invalid user ubuntu 197.44.15.210 port 36896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-09 18:26:44 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:32812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Dec  9 18:26:50 host2 sshd[1124030]: Disconnected from invalid user debian 133.117.72.88 port 38734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.54
country_id: 226074
description:
Dec  9 18:26:56 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.10.54, lip=66.85.158.91, TLS, session=<fr0scYRFeeLEAAo2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 18:27:54 dovecot_plain authenticator failed for (proposs) [65.20.160.107]:54775: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.44.15.210
country_id: 357994
description:
Dec  9 18:28:18 host2 sshd[1125157]: Disconnected from invalid user sammy 197.44.15.210 port 37864 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  9 18:27:34 host2 sshd[1124557]: Disconnected from invalid user ubuntu 198.12.114.232 port 59290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  9 18:28:53 host2 sshd[1125676]: Disconnected from invalid user wialon 198.12.114.232 port 35290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.44.15.210
country_id: 357994
description:
Dec  9 18:29:05 host2 sshd[1125850]: Disconnected from invalid user ops 197.44.15.210 port 52458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.44.15.210
country_id: 357994
description:
Dec  9 18:29:52 host2 sshd[1126392]: Disconnected from invalid user www 197.44.15.210 port 38822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Dec  9 18:30:20 host2 sshd[1127101]: Disconnected from invalid user apollo 133.117.72.88 port 59874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-09 18:31:02 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:58108: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  9 18:30:45 host2 sshd[1127401]: Disconnected from invalid user upload 198.12.114.232 port 56546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-09 18:30:52 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:47982: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.102
country_id: 6252001
description:
2025-12-09 18:32:40 dovecot_login authenticator failed for ([98.185.120.102]) [98.185.120.102]:48020: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-09 18:33:00 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:58856: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-09 18:33:01 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (batieve) [76.145.10.140]:55520: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-09 18:33:14 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:39744: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec  9 18:33:21 host2 sshd[1130003]: Disconnected from invalid user ubuntu 222.124.17.227 port 33830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Dec  9 18:33:23 host2 sshd[1130029]: Disconnected from invalid user ubuntu 196.204.240.61 port 39952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-09 18:33:39 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:39476: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 18:35:21 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<S3dVkIRF4sWKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Dec  9 18:34:41 host2 sshd[1131288]: Disconnected from invalid user wialon 196.204.240.61 port 58166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.98.58.236
country_id: 6251999
description:
Dec  9 18:36:31 host2 sshd[1133040]: Disconnected from invalid user test 3.98.58.236 port 52848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec  9 18:37:39 host2 sshd[1134082]: Disconnected from invalid user znc 222.124.17.227 port 41784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 18:38:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9fSxmoRFHMiKxX03>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec  9 18:38:19 host2 pure-ftpd[1134658]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-12-09 18:38:41 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:48705: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-09 18:38:55 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:47095: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 18:39:37 host2 sshd[1135626]: Disconnected from invalid user user 2.57.121.25 port 13787 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Dec  9 18:40:07 host2 sshd[1136110]: Disconnected from invalid user was 133.117.72.88 port 49934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.224.118
country_id: 6252001
description:
Dec  9 18:39:35 host2 sshd[1135621]: Disconnected from invalid user user2 107.175.224.118 port 40812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-09 18:40:58 dovecot_plain authenticator failed for (pignlinque) [65.20.164.137]:55649: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-09 18:41:02 dovecot_plain authenticator failed for (pinamolds) [5.31.23.133]:33614: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Dec  9 18:42:13 host2 sshd[1137948]: Disconnected from invalid user httpd 189.126.4.42 port 40998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.224.118
country_id: 6252001
description:
Dec  9 18:42:14 host2 sshd[1137988]: Disconnected from invalid user httpd 107.175.224.118 port 52672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.48.54.162
country_id: 3932488
description:
Dec  9 18:42:30 host2 sshd[1138168]: Disconnected from invalid user httpd 179.48.54.162 port 61978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.194
country_id: 3865483
description:
Dec  9 18:42:33 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=179.0.251.194, lip=66.85.158.91, TLS, session=<i4TwqIRFG5SzAPvC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.224.118
country_id: 6252001
description:
Dec  9 18:42:53 host2 sshd[1138568]: Disconnected from invalid user deploy 107.175.224.118 port 37288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec  9 18:42:56 host2 sshd[1138570]: Disconnected from invalid user user01 38.47.92.86 port 41782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec  9 18:43:21 host2 sshd[1138904]: Disconnected from invalid user admin 222.124.17.227 port 32920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-09 18:43:31 dovecot_plain authenticator failed for (coxyllione) [65.20.148.194]:35917: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.32
country_id: 798544
description:
Dec  9 18:42:50 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=178.216.27.32, lip=66.85.158.91, TLS, session=<lZ1AqoRFhMGy2Bsg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  9 18:44:09 host2 sshd[1139412]: Disconnected from invalid user wang 190.111.211.81 port 41836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec  9 18:44:13 host2 sshd[1139446]: Disconnected from invalid user gc 38.47.92.86 port 40660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-12-09 18:44:49 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:56950: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Dec  9 18:45:02 host2 sshd[1139977]: Disconnected from invalid user admin1 38.47.92.86 port 59328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.48.54.162
country_id: 3932488
description:
Dec  9 18:46:21 host2 sshd[1141662]: Disconnected from invalid user ansible 179.48.54.162 port 62929 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec  9 18:46:25 host2 sshd[1141678]: Disconnected from invalid user httpd 103.59.94.155 port 59552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-09 18:45:41 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:38054: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.193.84
country_id: 6252001
description:
Dec  9 18:46:02 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.193.84, lip=66.85.158.92, session=<ZkSktoRFCNal48FU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.17.227
country_id: 1643084
description:
Dec  9 18:46:04 host2 sshd[1141449]: Disconnected from invalid user hemant 222.124.17.227 port 56688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.45.3.241
country_id: 3175395
description:
Dec  9 18:46:15 host2 sshd[1141593]: Disconnected from invalid user httpd 2.45.3.241 port 41726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-09 18:46:28 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:57457: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Dec  9 18:46:34 host2 sshd[1141782]: Disconnected from invalid user wang 189.126.4.42 port 34550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec  9 18:46:36 host2 sshd[1141806]: Disconnected from invalid user httpd 72.144.12.31 port 47152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.45.3.241
country_id: 3175395
description:
Dec  9 18:46:50 host2 sshd[1141957]: Disconnected from invalid user pzuser 2.45.3.241 port 45122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  9 18:46:54 host2 sshd[1141984]: Disconnected from invalid user admin 190.111.211.81 port 53416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.224.118
country_id: 6252001
description:
Dec  9 18:47:12 host2 sshd[1142320]: Disconnected from invalid user admin 107.175.224.118 port 42576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.144.12.31
country_id: 2921044
description:
Dec  9 18:47:13 host2 sshd[1142322]: Disconnected from invalid user teamspeak 72.144.12.31 port 37574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec  9 18:47:20 host2 sshd[1142455]: Disconnected from invalid user ubuntu 103.59.94.155 port 34608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec  9 18:48:13 host2 sshd[1143185]: Disconnected from invalid user uzivatel 38.47.92.86 port 38592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  9 18:47:34 host2 sshd[1142687]: Disconnected from invalid user ubuntu 190.111.211.81 port 34452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec  9 18:47:48 host2 sshd[1142835]: Disconnected from invalid user ygh 197.248.104.31 port 43616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec  9 18:47:51 host2 sshd[1142904]: Disconnected from invalid user user01 72.144.12.31 port 38750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.45.3.241
country_id: 3175395
description:
Dec  9 18:49:11 host2 sshd[1143960]: Disconnected from invalid user runcloud 2.45.3.241 port 36462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.233.123
country_id: 1522867
description:
2025-12-09 18:49:14 dovecot_login authenticator failed for 95.58.233.123.dynamic.telecom.kz [95.58.233.123]:50644: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Dec  9 18:48:36 host2 sshd[1143427]: Disconnected from invalid user mailuser 197.248.104.31 port 46664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-09 18:49:02 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:42352: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.104.31
country_id: 192950
description:
Dec  9 18:50:46 host2 sshd[1145316]: Disconnected from invalid user thomas 197.248.104.31 port 38222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  9 18:51:04 host2 sshd[1145605]: Disconnected from invalid user kontakt 190.111.211.81 port 44874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec  9 18:51:22 host2 sshd[1145843]: Disconnected from invalid user labuser 103.59.94.155 port 58198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Dec  9 18:52:14 host2 sshd[1146679]: Disconnected from invalid user postgres 103.59.94.155 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec  9 18:53:13 host2 sshd[1147658]: Disconnected from invalid user es_user 166.170.48.43 port 2665 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.154
country_id: 953987
description:
Dec  9 18:53:12 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.64.39.154, lip=66.85.158.91, TLS, session=<msjqzoRFn7dmQCea>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.82.151
country_id: 3469034
description:
Dec  9 18:53:32 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.82.151, lip=66.85.158.91, TLS, session=<IUxn0IRFNbCxLFKX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.45.3.241
country_id: 3175395
description:
Dec  9 18:52:35 host2 sshd[1147043]: Disconnected from invalid user prakash 2.45.3.241 port 57008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.143
country_id: 3996063
description:
2025-12-09 18:53:58 dovecot_login authenticator failed for (201.173.216.143-clientes-izzi.mx) [201.173.216.143]:40633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-12-09 18:54:13 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:65015: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.33.209
country_id: 1522867
description:
2025-12-09 18:54:13 dovecot_login authenticator failed for 2.135.33.209.dynamic.telecom.kz [2.135.33.209]:40350: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Dec  9 18:53:54 host2 sshd[1148194]: Disconnected from invalid user wg 166.170.48.43 port 12813 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-09 18:54:34 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:38904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec  9 18:55:04 host2 sshd[1149929]: Disconnected from invalid user testuser 186.30.115.187 port 40154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec  9 18:55:05 host2 sshd[1149973]: Disconnected from invalid user username 166.170.48.43 port 61093 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-12-09 18:55:20 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:50074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.108
country_id: 2510769
description:
Dec  9 18:55:20 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.74.243.108, lip=66.85.158.91, TLS, session=<e/7f1oRF6aq5SvNs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec  9 18:55:33 host2 sshd[1150517]: Disconnected from invalid user devadmin 209.141.43.77 port 49942 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.89.30.128
country_id: 2921044
description:
Dec  9 18:56:24 host2 pure-ftpd[1151373]: (?@159.89.30.128) [INFO] New connection from 159.89.30.128


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 159.89.30.128
country_id: 2921044
description:
Dec  9 18:56:27 host2 pure-ftpd[1151460]: (?@159.89.30.128) [INFO] New connection from 159.89.30.128


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 18:55:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Cq6s2YRF0oG8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.203.236.212
country_id: 1512440
description:
Dec  9 18:55:47 host2 sshd[1150879]: Disconnected from invalid user test6 185.203.236.212 port 51490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 18:56:04 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:34716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec  9 18:55:41 host2 sshd[1150708]: Disconnected from invalid user ubuntu 166.170.48.43 port 12907 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.93
country_id: 2300660
description:
Dec  9 18:55:45 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=41.139.0.93, lip=66.85.158.91, TLS, session=<vWQi2IRFNtIpiwBd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 18:57:34 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<WBnD34RFJpeqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  9 18:58:05 host2 sshd[1152645]: Disconnected from invalid user  62.60.131.157 port 7078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.203.236.212
country_id: 1512440
description:
Dec  9 18:58:27 host2 sshd[1152819]: Disconnected from invalid user loki 185.203.236.212 port 59098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec  9 18:58:30 host2 sshd[1152854]: Disconnected from invalid user vpn 186.30.115.187 port 46530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Dec  9 18:58:48 host2 sshd[1153104]: Disconnected from invalid user anil 66.116.196.243 port 54372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.181.69.132
country_id: 3469034
description:
Dec  9 18:58:52 host2 sshd[1153148]: Disconnected from invalid user devadmin 108.181.69.132 port 46080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec  9 18:59:10 host2 sshd[1153499]: Disconnected from invalid user ubuntu 209.141.43.77 port 42326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Dec  9 18:59:16 host2 sshd[1153621]: Disconnected from invalid user serge 186.30.115.187 port 60362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-09 19:00:34 dovecot_plain authenticator failed for (aperan) [65.20.164.137]:58459: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.203.236.212
country_id: 1512440
description:
Dec  9 18:59:50 host2 sshd[1153958]: Disconnected from invalid user user 185.203.236.212 port 38560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-09 19:00:09 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:53482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.181.69.132
country_id: 3469034
description:
Dec  9 19:00:19 host2 sshd[1154639]: Disconnected from invalid user test 108.181.69.132 port 43360 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.53.228.211
country_id: 1527747
description:
2025-12-09 19:00:31 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [185.53.228.211]:20816: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec  9 19:00:51 host2 sshd[1155023]: Disconnected from invalid user user 172.190.42.55 port 36084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-09 19:01:20 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:33182: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Dec  9 19:01:24 host2 sshd[1155460]: Disconnected from invalid user anil 186.30.115.187 port 45392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-09 19:00:36 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (skatemibre) [76.16.7.82]:55810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.110
country_id: 1269750
description:
2025-12-09 19:02:00 dovecot_login authenticator failed for ([182.95.228.110]) [182.95.228.110]:55690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-09 19:02:03 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:41715: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.146
country_id: 6252001
description:
Dec  9 19:02:30 host2 sshd[1156264]: Disconnected from invalid user andrew 107.174.26.146 port 46712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.40
country_id: 6252001
description:
2025-12-09 19:01:38 dovecot_login authenticator failed for ([98.181.46.40]) [98.181.46.40]:33117: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-09 19:01:38 dovecot_plain authenticator failed for (nofierible) [46.10.210.68]:42117: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.80.249
country_id: 6252001
description:
Dec  9 19:02:53 host2 sshd[1156497]: Disconnected from invalid user hik 23.94.80.249 port 51920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.181.69.132
country_id: 3469034
description:
Dec  9 19:03:49 host2 sshd[1157451]: Disconnected from invalid user ftpuser1 108.181.69.132 port 50684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.26.146
country_id: 6252001
description:
Dec  9 19:04:21 host2 sshd[1157753]: Disconnected from invalid user myuser 107.174.26.146 port 54218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.42.55
country_id: 6252001
description:
Dec  9 19:04:44 host2 sshd[1158057]: Disconnected from invalid user developer 172.190.42.55 port 58630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.234.38.4
country_id: 130758
description:
Dec  9 19:06:13 host2 sshd[1159478]: Disconnected from invalid user user 91.234.38.4 port 38008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.42.55
country_id: 6252001
description:
Dec  9 19:06:40 host2 sshd[1159696]: Disconnected from invalid user teste2 172.190.42.55 port 37578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.80.249
country_id: 6252001
description:
Dec  9 19:06:38 host2 sshd[1159685]: Disconnected from invalid user liz 23.94.80.249 port 37766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.48.54.162
country_id: 3932488
description:
Dec  9 19:08:42 host2 sshd[1160929]: Disconnected from invalid user webdev 179.48.54.162 port 62575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.80.249
country_id: 6252001
description:
Dec  9 19:08:43 host2 sshd[1160944]: Disconnected from invalid user ubuntu 23.94.80.249 port 47244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.234.38.4
country_id: 130758
description:
Dec  9 19:09:11 host2 sshd[1161325]: Disconnected from invalid user wk 91.234.38.4 port 56248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.48.54.162
country_id: 3932488
description:
Dec  9 19:09:43 host2 sshd[1161812]: Disconnected from invalid user speedtest 179.48.54.162 port 62086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-09 19:10:38 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:42188: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 19:10:42 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<my/BDoVFPNWqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-09 19:10:49 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:46863: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-09 19:14:32 dovecot_plain authenticator failed for (unhus) [65.20.233.110]:47378: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.139
country_id: 6252001
description:
2025-12-09 19:14:34 dovecot_login authenticator failed for wsip-184-191-250-139.fv.ks.cox.net [184.191.250.139]:37233: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-09 19:14:45 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:41309: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 19:15:49 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<kz0DIYVF/pePbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-12-09 19:16:12 dovecot_plain authenticator failed for (vages) [65.20.163.103]:37247: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec  9 19:17:25 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<mme6JoVFtcUm/ya3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 19:18:06 host2 sshd[1168740]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-09 19:19:50 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:53646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-09 19:20:03 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:50272: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-09 19:20:08 dovecot_login authenticator failed for 213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:46636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-09 19:20:27 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:55962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-09 19:21:12 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:38206: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-09 19:21:33 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:38004: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.51
country_id: 1819730
description:
Dec  9 19:20:58 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.51, lip=66.85.158.92, session=<oiuXM4VF3tstjpoz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-09 19:22:22 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (delwain) [196.47.172.253]:41149: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 19:22:35 host2 sshd[1172018]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 19:23:59 host2 sshd[1173086]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-09 19:26:03 dovecot_login authenticator failed for ([182.95.197.193]) [182.79.87.18]:54058: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-09 19:26:15 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:50425: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-09 19:26:31 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:47159: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2025-12-09 19:26:41 dovecot_login authenticator failed for (nsg-corporate-201.229.187.122.airtel.in) [122.187.229.201]:60249: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.100
country_id: 6252001
description:
2025-12-09 19:26:53 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:45290: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2025-12-09 19:26:56 dovecot_login authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:56650: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-09 19:26:56 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:33402: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-09 19:27:10 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:41384: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-09 19:27:34 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:40183: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.60
country_id: 6252001
description:
2025-12-09 19:26:38 dovecot_login authenticator failed for ([98.185.120.60]) [98.185.120.60]:35428: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.98.187
country_id: 6252001
description:
Dec  9 19:28:26 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=198.211.98.187, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WelMToVFKMjG02K7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 19:29:36 host2 sshd[1176956]: Disconnected from invalid user admin 2.57.121.112 port 18006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-09 19:31:07 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (chotous) [196.47.172.253]:39738: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-09 19:31:10 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (halozewbet) [76.97.155.25]:58112: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 19:30:49 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<IS6xVoVFQsqKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-09 19:31:02 dovecot_plain authenticator failed for (scatrines) [102.53.15.56]:55047: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 19:33:37 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<UreyYIVF6seKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-09 19:36:37 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:59544: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-09 19:36:54 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:56746: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-09 19:41:02 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:60969: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-09 19:40:44 dovecot_plain authenticator failed for (upeny) [65.20.133.4]:35444: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-09 19:40:48 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:36282: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-09 19:40:48 dovecot_plain authenticator failed for (obstly) [65.20.133.208]:50483: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-09 19:40:49 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (lesid) [96.230.65.90]:47026: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.18
country_id: 1819730
description:
Dec  9 19:42:27 host2 sshd[1187038]: Disconnected from invalid user cse 156.241.128.18 port 54414 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-09 19:44:32 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:53648: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-09 19:44:57 dovecot_login authenticator failed for ([182.95.85.106]) [27.123.90.94]:43734: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-09 19:45:54 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:48699: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-09 19:46:00 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:37584: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-09 19:46:05 dovecot_login authenticator failed for (159-161-97-62.cust.smartcall.no) [62.97.161.159]:42610: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.18
country_id: 1819730
description:
Dec  9 19:47:05 host2 sshd[1191910]: Disconnected from invalid user frappe 156.241.128.18 port 34896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-09 19:47:24 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:63070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-09 19:46:42 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:38005: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-09 19:47:37 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:44622: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 19:47:56 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:60397: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-09 19:48:18 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:38322: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.19.227
country_id: 6252001
description:
Dec  9 19:48:43 host2 sshd[1193209]: Disconnected from invalid user webdev 37.46.19.227 port 38152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.19.227
country_id: 6252001
description:
Dec  9 19:50:20 host2 sshd[1194832]: Disconnected from invalid user vpn 37.46.19.227 port 40558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec  9 19:49:37 host2 sshd[1194091]: Disconnected from invalid user mailuser 20.127.224.153 port 44302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.46.19.227
country_id: 6252001
description:
Dec  9 19:51:23 host2 sshd[1195571]: Disconnected from invalid user cds 37.46.19.227 port 37574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec  9 19:50:59 host2 sshd[1195281]: Disconnected from invalid user test10 20.127.224.153 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-09 19:52:05 dovecot_plain authenticator failed for (patimongs) [81.0.54.119]:54976: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec  9 19:52:07 host2 sshd[1196161]: Disconnected from invalid user test10 213.142.151.19 port 41408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec  9 19:51:38 host2 sshd[1195854]: Disconnected from invalid user centos 20.127.224.153 port 41898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-09 19:51:47 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:39730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-09 19:51:59 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:45455: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 37.46.19.227
country_id: 6252001
description:
Dec  9 19:52:59 host2 sshd[1196688]: Received disconnect from 37.46.19.227 port 50596:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.19.227
country_id: 6252001
description:
Dec  9 19:52:59 host2 sshd[1196688]: Disconnected from invalid user mailuser 37.46.19.227 port 50596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 19:53:23 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SZlcp4VFItmqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.177.194
country_id: 1210997
description:
Dec  9 19:52:37 host2 sshd[1196461]: Disconnected from invalid user cse 175.29.177.194 port 46842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-09 19:52:39 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50042: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-09 19:52:49 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:33750: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 19:53:55 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1Uw+qYVFIrAXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.177.194
country_id: 1210997
description:
Dec  9 19:54:06 host2 sshd[1197754]: Disconnected from invalid user vpn 175.29.177.194 port 43940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec  9 19:55:07 host2 sshd[1199028]: Disconnected from invalid user webdev 213.142.151.19 port 60110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec  9 19:55:56 host2 sshd[1199782]: Disconnected from invalid user cds 213.142.151.19 port 34062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 19:56:23 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<K0YZsoVFBL68putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.110
country_id: 3469034
description:
Dec  9 20:01:55 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.189.201.110, lip=66.85.158.91, TLS, session=<iQTkxIVFYbuzvclu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-09 20:02:17 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:46112: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.45
country_id: 3865483
description:
Dec  9 20:02:23 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=186.1.224.45, lip=66.85.158.91, TLS, session=<FuVMxoVFqa66AeAt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-09 20:02:32 dovecot_login authenticator failed for ([182.95.181.22]) [182.95.181.22]:39844: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 20:04:46 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-09 20:05:32 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:46738: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-09 20:06:17 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:50008: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 20:06:25 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<klAE1oVFwKGqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 20:07:58 host2 sshd[1209740]: Disconnected from invalid user user 2.57.121.25 port 26546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.150.159
country_id: 3144096
description:
2025-12-09 20:10:09 dovecot_login authenticator failed for (cm-84.210.150.159.get.no) [84.210.150.159]:57249: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-09 20:10:23 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:47710: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-09 20:10:36 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:48009: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-12-09 20:10:54 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:45662: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-09 20:12:04 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:35063: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-09 20:11:50 dovecot_login authenticator failed for ([203.192.97.23]) [203.192.97.23]:51886: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 20:14:24 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<6eyF8oVF3rqPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-09 20:15:47 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:33601: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-09 20:16:02 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:45226: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-09 20:17:04 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:46690: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.233.123
country_id: 1522867
description:
2025-12-09 20:16:36 dovecot_login authenticator failed for 95.58.233.123.dynamic.telecom.kz [95.58.233.123]:38046: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-09 20:19:08 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (seling) [68.46.148.180]:59078: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.173
country_id: 6252001
description:
2025-12-09 20:18:46 dovecot_login authenticator failed for (89.187.173.173) [89.187.173.173]:43392: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-09 20:21:21 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (baciatures) [217.215.74.195]:59160: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.236.190
country_id: 1269750
description:
2025-12-09 20:21:21 dovecot_plain authenticator failed for (L7V1JJ7) [49.36.236.190]:62058: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 20:22:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (romati) [87.103.126.54]:54180: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-09 20:22:05 dovecot_plain authenticator failed for (bited) [65.20.129.28]:60273: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-09 20:22:07 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (alizate) [98.40.101.10]:44374: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-09 20:22:49 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:38038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.117.199.59
country_id: 433561
description:
2025-12-09 20:23:02 dovecot_login authenticator failed for ([154.117.199.59]) [154.117.199.59]:39404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-09 20:23:34 dovecot_plain authenticator failed for (sannymog) [37.25.36.197]:56116: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec  9 20:23:44 host2 pure-ftpd[1223083]: (?@66.132.153.112) [INFO] New connection from 66.132.153.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-09 20:24:08 dovecot_plain authenticator failed for (matiostat) [102.53.15.180]:39724: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-09 20:24:18 dovecot_login authenticator failed for (cm-178.232.55.16.get.no) [178.232.55.16]:57789: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-09 20:24:49 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51390: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-09 20:25:02 dovecot_login authenticator failed for ([128.185.246.106]) [128.185.246.106]:47648: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 20:25:03 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<HU2kGIZFct6KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-09 20:25:09 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (lizered) [68.60.77.128]:56466: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.253.86
country_id: 798544
description:
2025-12-09 20:25:31 dovecot_login authenticator failed for apn-87-251-253-86.static.gprs.plus.pl [87.251.253.86]:50790: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-09 20:25:45 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:56371: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-09 20:26:06 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:44612: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-12-09 20:27:04 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:50892: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-09 20:27:16 dovecot_plain authenticator failed for (ingraxes) [154.144.255.208]:41034: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-09 20:27:33 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:7315: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 20:27:56 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<WQP1IoZFUN2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-09 20:30:28 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:58262: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-09 20:30:46 dovecot_login authenticator failed for ([115.248.4.85]) [115.248.4.85]:50479: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-09 20:34:52 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:51706: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-09 20:35:13 dovecot_login authenticator failed for (201.172.88.155-clientes-izzi.mx) [201.172.88.155]:38110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-09 20:35:22 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:60118: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-12-09 20:35:25 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:56681: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-12-09 20:36:07 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:38612: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-09 20:37:07 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:44613: 535 Incorrect authentication data (set_id=contact)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 216.81.245.140
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 216.81.245.140: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 20:39:14 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<iMlaS4ZFUuEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec  9 20:40:47 host2 sshd[1239175]: Disconnected from invalid user myuser 205.185.127.60 port 60050 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.85.106
country_id: 2264397
description:
[2025-12-09 20:40:51 +0530] info [webmaild] 130.185.85.106 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-09 20:41:02 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:37532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-09 20:41:15 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:46205: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.6
country_id: 6252001
description:
Dec  9 20:41:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.6, lip=66.85.158.92, session=<uLKuU4ZFVd1b5qgG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.15
country_id: 6252001
description:
Dec  9 20:41:42 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.15, lip=66.85.158.92, session=<6XpJVIZFXZxb5qgP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-09 20:41:50 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:51471: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.3
country_id: 6252001
description:
Dec  9 20:41:48 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.3, lip=66.85.158.92, session=<xASoVIZFe99b5qgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec  9 20:41:51 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.11, lip=66.85.158.92, session=<ifnWVIZFSb5b5qgL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-12-09 20:42:07 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:46466: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 20:42:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1dJjV4ZF3KEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec  9 20:43:22 host2 sshd[1241128]: Disconnected from invalid user cloud 205.185.127.60 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 20:43:34 host2 sshd[1241255]: Disconnected from invalid user admin 2.57.121.112 port 53582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.127.60
country_id: 6252001
description:
Dec  9 20:45:21 host2 sshd[1243751]: Disconnected from invalid user admin 205.185.127.60 port 60962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec  9 20:46:04 host2 sshd[1244295]: Disconnected from invalid user zz 205.185.127.60 port 47386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.37.168
country_id: 298795
description:
Dec  9 20:46:33 host2 sshd[1244592]: Disconnected from invalid user myuser 101.44.37.168 port 58278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.246.130
country_id: 690791
description:
Dec  9 20:47:07 host2 sshd[1245054]: Disconnected from invalid user angel 82.117.246.130 port 42290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-09 20:47:11 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:36135: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-09 20:47:24 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:59878: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.82.128.4
country_id: 1605651
description:
Dec  9 20:47:26 host2 sshd[1245273]: Disconnected from invalid user sql 58.82.128.4 port 25876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec  9 20:46:42 host2 sshd[1244703]: Disconnected from invalid user ec2-user 205.185.127.60 port 33802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.37.168
country_id: 298795
description:
Dec  9 20:47:57 host2 sshd[1245676]: Disconnected from invalid user builduser 101.44.37.168 port 33702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.117.246.130
country_id: 690791
description:
Dec  9 20:48:17 host2 sshd[1245993]: Disconnected from invalid user cloud 82.117.246.130 port 49754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 20:48:21 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<0eTta4ZF5MqqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.226.236.13
country_id: 2635167
description:
Dec  9 20:47:38 host2 sshd[1245389]: Disconnected from invalid user erpuser 138.226.236.13 port 52438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.246.130
country_id: 690791
description:
Dec  9 20:47:43 host2 sshd[1245488]: Disconnected from invalid user myuser 82.117.246.130 port 56290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.226.236.13
country_id: 2635167
description:
Dec  9 20:49:40 host2 sshd[1247099]: Disconnected from invalid user postgres 138.226.236.13 port 59426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.37.168
country_id: 298795
description:
Dec  9 20:49:55 host2 sshd[1247276]: Disconnected from invalid user ubuntu 101.44.37.168 port 44244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.117.246.130
country_id: 690791
description:
Dec  9 20:50:00 host2 sshd[1247404]: Disconnected from invalid user zz 82.117.246.130 port 46766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-09 20:51:05 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51060: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-09 20:51:23 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:59755: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-09 20:50:52 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:35910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-09 20:51:35 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:34010: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.226.236.13
country_id: 2635167
description:
Dec  9 20:51:35 host2 sshd[1248989]: Disconnected from invalid user sysadmin 138.226.236.13 port 42008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.82.128.4
country_id: 1605651
description:
Dec  9 20:52:05 host2 sshd[1249403]: Disconnected from invalid user macro 58.82.128.4 port 13594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.226.236.13
country_id: 2635167
description:
Dec  9 20:53:36 host2 sshd[1250670]: Disconnected from invalid user backend 138.226.236.13 port 37494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-09 20:54:24 dovecot_login authenticator failed for (201.173.216.96-clientes-izzi.mx) [201.173.216.96]:36364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.37.168
country_id: 298795
description:
Dec  9 20:54:28 host2 sshd[1251591]: Disconnected from invalid user cloud 101.44.37.168 port 45810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-12-09 20:55:26 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:46766: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2025-12-09 20:55:44 dovecot_login authenticator failed for ([24.83.135.122]) [24.83.135.122]:46300: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 20:57:11 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<98GMi4ZFYOG8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-09 21:00:15 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:46002: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-09 21:00:26 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:55856: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-09 21:00:29 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:33897: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-09 20:59:53 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:57516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-09 21:00:06 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:58734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.50
country_id: 6252001
description:
2025-12-09 21:01:19 dovecot_login authenticator failed for ([98.181.46.50]) [98.181.46.50]:55235: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 21:01:20 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<9VFpmoZFJo2qQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.136
country_id: 6252001
description:
2025-12-09 21:00:41 dovecot_login authenticator failed for wsip-184-191-250-136.fv.ks.cox.net [184.191.250.136]:58019: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-09 21:01:38 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:33189: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-09 21:04:32 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:56750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-09 21:04:55 dovecot_login authenticator failed for (nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:56910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-09 21:05:34 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:51210: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-09 21:06:04 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:63966: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-09 21:05:53 dovecot_login authenticator failed for ([89.218.247.234]) [89.218.247.234]:38850: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-09 21:06:49 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:38362: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-09 21:07:03 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:38574: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 21:09:40 host2 sshd[1265412]: Disconnected from invalid user user 2.57.121.25 port 19009 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.104.245.34
country_id: 3996063
description:
Dec  9 21:11:11 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=38.104.245.34, lip=66.85.158.91, TLS, session=<Cu+ivIZF0ekmaPUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.17.49
country_id: 3175395
description:
Dec  9 21:11:29 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.43.17.49, lip=66.85.158.91, TLS, session=<ePDWvYZFW5C5KxEx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 21:11:33 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<7WnsvoZF1qqPbvgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.55
country_id: 6252001
description:
Dec  9 21:17:29 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.55, lip=66.85.158.91, session=<MIdL1IZFw9tBMQE3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec  9 21:17:42 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<KAAP1YZF0i9BMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec  9 21:17:43 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, session=<skYb1YZFhgnY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec  9 21:17:54 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, session=<ymzD1YZFZqhBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec  9 21:17:57 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS: Connection closed, session=<92Tx1YZFHGDY2s5C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-09 21:18:51 dovecot_login authenticator failed for ([89.101.36.159]) [89.101.36.159]:40774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 21:19:34 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<76Gg24ZFguaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.146
country_id: 3996063
description:
2025-12-09 21:20:00 dovecot_login authenticator failed for (187.161.222.146-clientes-izzi.mx) [187.161.222.146]:58268: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-09 21:20:13 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:45746: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec  9 21:21:00 host2 pure-ftpd[1276250]: (?@66.132.153.128) [INFO] New connection from 66.132.153.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-09 21:22:10 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:48172: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 21:22:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<tvX15YZFpuOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-09 21:24:37 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:35294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.177.145
country_id: 192950
description:
2025-12-09 21:25:26 dovecot_login authenticator failed for ([197.231.177.145]) [197.231.177.145]:34913: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-09 21:25:21 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:59366: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-09 21:26:09 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:44918: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-09 21:26:27 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:35133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-09 21:29:13 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (hagetly) [98.227.25.115]:55518: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 21:28:55 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-09 21:30:36 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:47110: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-09 21:31:05 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:62529: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.94
country_id: 3175395
description:
Dec  9 21:34:51 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=185.15.169.94, lip=66.85.158.91, TLS, session=<ZuNiEYdFyLS5D6le>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.149
country_id: 953987
description:
Dec  9 21:35:18 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<contact>, method=PLAIN, rip=102.129.56.149, lip=66.85.158.91, TLS, session=<Kx2pEodFGaBmgTiV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 21:40:18 host2 sshd[1305673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 21:41:41 host2 sshd[1306714]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.234.3
country_id: 798544
description:
Dec  9 21:41:01 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=109.125.234.3, lip=66.85.158.91, TLS, session=<i197J4dFyIltfeoD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-12-09 21:41:14 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:40092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.217
country_id: 953987
description:
Dec  9 21:41:23 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<marketing>, method=PLAIN, rip=102.64.32.217, lip=66.85.158.91, TLS, session=<bJmXKIdFk4FmQCDZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-09 21:41:58 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:55345: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 21:43:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<S9JTMIdFzrCqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-09 21:43:21 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (bralliker) [96.230.65.90]:54090: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 21:44:38 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-12-09 21:45:24 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:46442: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.207
country_id: 1733045
description:
2025-12-09 21:46:12 dovecot_login authenticator failed for ([49.124.149.207]) [49.124.149.207]:45492: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2025-12-09 21:50:36 dovecot_login authenticator failed for ([167.250.118.12]) [167.250.118.12]:44792: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-09 21:50:44 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:56166: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-09 21:50:30 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:58032: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-09 21:52:12 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:48226: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-09 21:52:26 dovecot_login authenticator failed for ([125.19.162.102]) [125.19.162.102]:42666: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 21:56:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<D2CFXodF/smqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.117.199.59
country_id: 433561
description:
2025-12-09 21:56:19 dovecot_login authenticator failed for ([154.117.199.59]) [154.117.199.59]:41264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-12-09 21:56:37 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [91.102.231.190]:57383: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-09 21:57:02 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:41840: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-09 21:57:25 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:49937: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 21:57:47 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<ZeFMZIdFuLO8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 21:56:57 host2 sshd[1333734]: Disconnected from invalid user admin 2.57.121.112 port 64728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-09 22:01:32 dovecot_login authenticator failed for ([172.82.64.201]) [172.82.64.201]:33972: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.130.225.179
country_id: 130758
description:
Dec  9 22:01:48 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts>, method=PLAIN, rip=95.130.225.179, lip=66.85.158.91, TLS, session=<ZpiHcYdFmAxfguGz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-09 22:00:55 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:46958: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-09 22:00:57 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:33996: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-12-09 22:01:02 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:36613: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2025-12-09 22:01:16 dovecot_login authenticator failed for ([27.123.104.102]) [27.123.104.102]:33274: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.207
country_id: 953987
description:
Dec  9 22:01:25 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.129.62.207, lip=66.85.158.91, TLS, session=<Q2tNcIdFuaRmgT7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2025-12-09 22:01:52 dovecot_login authenticator failed for ([24.83.135.122]) [24.83.135.122]:38900: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.104.190
country_id: 3469034
description:
Dec  9 22:02:45 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.216.104.190, lip=66.85.158.91, TLS, session=<rwwOdYdFU9a62Gi+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.54.18.18
country_id: 2623032
description:
Dec  9 22:03:12 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=87.54.18.18, lip=66.85.158.91, TLS, session=<rkR7dodFKKBXNhIS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-09 22:06:24 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:53596: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-09 22:06:43 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:43188: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 22:09:14 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<NkY1jYdFZpSPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 22:09:39 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<T4+2jodFWIsf3Dhi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.250
country_id: 1733045
description:
2025-12-09 22:10:07 dovecot_login authenticator failed for ([49.124.150.250]) [49.124.150.250]:38128: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 22:11:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56005: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 22:17:07 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9u1tqYdFwO2KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-09 22:20:37 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:51762: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.106
country_id: 3175395
description:
Dec  9 22:20:41 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training@v-deploy.com>, method=PLAIN, rip=217.26.178.106, lip=66.85.158.91, TLS, session=<vwFUtYdFhdfZGrJq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-12-09 22:20:51 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:36646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.6
country_id: 953987
description:
Dec  9 22:21:03 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=102.64.40.6, lip=66.85.158.91, TLS, session=<XwF3todFhb5mQCgG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-09 22:21:31 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:60768: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-09 22:22:20 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:52294: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.135
country_id: 6252001
description:
Dec  9 22:21:36 host2 pure-ftpd[1353854]: (?@205.210.31.135) [INFO] New connection from 205.210.31.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.177.94.124
country_id: 3017382
description:
[2025-12-09 22:21:42 +0530] info [cpaneld] 195.177.94.124 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Dec  9 22:21:41 host2 sshd[1353908]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 50333


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-09 22:22:48 dovecot_plain authenticator failed for (inasi) [65.20.184.80]:58576: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Dec  9 22:24:33 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS: Connection closed, session=<5O0kxIdFkrJChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  9 22:25:12 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<NuROxodFsKRIPG+y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  9 22:25:53 host2 sshd[1357556]: Disconnected from invalid user  62.60.131.157 port 52012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-09 22:30:54 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:43702: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-09 22:31:23 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:48892: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-09 22:32:59 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (bater) [24.91.103.202]:36572: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-09 22:35:03 dovecot_login authenticator failed for ([152.52.234.4]) [152.52.231.202]:56738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-09 22:35:26 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:56698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 22:36:45 host2 sshd[1366105]: Disconnected from invalid user user 2.57.121.25 port 19320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-09 22:36:52 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (ingundea) [144.64.157.244]:58198: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-09 22:36:56 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (diongs) [98.222.93.199]:42862: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 22:37:39 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Gs/S8odFnsWqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.91
country_id: 6252001
description:
Dec  9 22:37:40 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.106.91, lip=66.85.158.92, session=<xF4M84dFZpwUQGpb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-09 22:40:15 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:54207: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-09 22:40:16 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:34482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-09 22:40:38 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:60904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-12-09 22:41:04 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:62696: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-12-09 22:41:33 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:48730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.97
country_id: 6252001
description:
Dec  9 22:42:02 host2 pure-ftpd[1371109]: (?@205.210.31.97) [INFO] New connection from 205.210.31.97


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-09 22:42:20 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:57512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.177.94.124
country_id: 3017382
description:
[2025-12-09 22:43:31 +0530] info [cpaneld] 195.177.94.124 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Dec  9 22:43:30 host2 sshd[1372285]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 50884


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-09 22:46:33 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:51947: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-09 22:47:30 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:56490: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-09 22:47:32 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:34320: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-09 22:48:14 dovecot_plain authenticator failed for (watio) [102.53.15.180]:36000: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


