# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.4
country_id: 1269750
description:
Nov 16 04:37:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.58.65.4, lip=66.85.158.91, TLS, session=<AEGPK6pDop5nOkEE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:37:38 host2 sshd[1139608]: Disconnected from invalid user k8s 152.32.218.244 port 45780 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:38:22 host2 sshd[1140001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:40:16 host2 sshd[1141074]: Disconnected from invalid user dev 152.32.218.244 port 44460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:40:33 host2 sshd[1141312]: Disconnected from invalid user user 151.69.80.240 port 38804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:42:44 host2 sshd[1142574]: Disconnected from invalid user rmartinez 152.32.218.244 port 43150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:44:04 host2 sshd[1143348]: Disconnected from invalid user tester 104.168.101.178 port 52532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:45:33 host2 sshd[1144973]: Disconnected from invalid user fns 104.168.101.178 port 56448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:46:57 host2 sshd[1145748]: Disconnected from invalid user cma 104.168.101.178 port 53120 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:48:08 host2 sshd[1146364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 04:58:13 host2 sshd[1152424]: Disconnected from invalid user hadoop 147.182.173.108 port 45400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.22
country_id: 3175395
description:
Nov 16 04:59:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.22, lip=66.85.158.91, TLS, session=<OfQ6e6pDX+TZGrIW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.122
country_id: 953987
description:
Nov 16 04:59:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.51.122, lip=66.85.158.91, TLS, session=<xE6IfKpD/uFmgTN6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:02:48 host2 sshd[1155855]: Disconnected from invalid user pool 147.182.173.108 port 52090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:03:55 host2 sshd[1156990]: Disconnected from invalid user psn 147.182.173.108 port 36670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:07:11 host2 sshd[1159228]: Disconnected from invalid user ubuntu 147.182.173.108 port 44496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.82
country_id: 3469034
description:
Nov 16 05:08:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.170.82, lip=66.85.158.91, TLS, session=<KdF1mqpDeuOxgqpS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:08:16 host2 sshd[1159964]: Disconnected from invalid user botuser 147.182.173.108 port 44646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.205.89
country_id: 3175395
description:
Nov 16 05:08:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=109.70.205.89, lip=66.85.158.91, TLS, session=<kvCmm6pDCZ9tRs1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-16 05:11:36 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (storoed) [81.226.88.121]:47256: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:12:30 host2 sshd[1162526]: Disconnected from invalid user pool 45.78.198.115 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:15:11 host2 sshd[1164068]: Disconnected from invalid user botuser 45.78.198.115 port 47708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-16 05:16:10 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:39155: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.143
country_id: 732800
description:
Nov 16 05:16:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.143, lip=66.85.158.91, TLS, session=<1WmluKpDR+G5/9SP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Nov 16 05:16:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<deW/uapDBb+5xQmt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-16 05:16:24 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:43765: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:20:23 host2 sshd[1167164]: Disconnected from invalid user gmodserver 45.78.198.115 port 47210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-16 05:23:25 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (kagial) [73.195.211.98]:47856: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 05:30:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:46918: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:30:55 host2 sshd[1173667]: Disconnected from invalid user ubuntu 45.78.198.115 port 57298 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 05:34:05 host2 sshd[1175572]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.148
country_id: 1269750
description:
Nov 16 05:37:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.148, lip=66.85.158.91, TLS, session=<E4DAAqtDeM9nM9+U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.223
country_id: 3865483
description:
Nov 16 05:37:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.97.223, lip=66.85.158.91, TLS, session=<cJr9A6tDer2+tWHf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-11-16 05:41:13 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-11-16 05:41:47 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:45292: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-16 05:42:05 dovecot_login authenticator failed for ([125.19.175.128]) [27.123.112.90]:35596: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-16 05:42:20 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45848: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 16 05:46:28 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<4cJdJKtDkPqs7ORz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 05:48:13 host2 sshd[1184318]: Disconnected from invalid user trisha 62.60.131.157 port 48593 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 05:48:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56177: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.250.168
country_id: 2921044
description:
Nov 16 05:51:34 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.248.250.168, lip=66.85.158.92, TLS, session=<Q1uVNqtDUKxo+Pqo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.199
country_id: 3469034
description:
Nov 16 06:00:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.44.96.199, lip=66.85.158.91, TLS, session=<4tvSVatD79GxLGDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.51
country_id: 953987
description:
Nov 16 06:01:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=102.129.54.51, lip=66.85.158.91, TLS, session=<jMWHV6tDn4hmgTYz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 06:01:19 host2 sshd[1192448]: Disconnected from invalid user trisha 62.60.131.157 port 7664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-16 06:11:56 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:43281: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.46
country_id: 3175395
description:
Nov 16 06:13:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.46, lip=66.85.158.91, TLS, session=<UpH7hKtDH9m5xQku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.110
country_id: 3175395
description:
Nov 16 06:14:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=217.26.179.110, lip=66.85.158.91, TLS, session=<7OsahqtDOsbZGrNu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:14:59 host2 sshd[1201992]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:16:39 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:37159: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.189
country_id: 6252001
description:
Nov 16 06:19:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pToFm6tDl8eTuYS9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:21:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:13224: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:24:46 host2 sshd[1207713]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:26:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:21096: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-16 06:30:50 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:59090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:31:42 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:45311: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-16 06:31:52 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:60558: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-16 06:31:37 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45181: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.75
country_id: 953987
description:
Nov 16 06:34:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.33.75, lip=66.85.158.91, TLS, session=<8LqIz6tDdopmQCFL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.126
country_id: 798544
description:
Nov 16 06:34:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.246.213.126, lip=66.85.158.91, TLS, session=<xf/D0KtDHdpb9tV+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:36:47 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:47283: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:40:44 host2 sshd[1218636]: Disconnected from invalid user user 2.57.121.25 port 28803 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<D0Z57KtDfJUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Io9+7KtDipUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:13 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<WKt59qtDtuADiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:22 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gbQC96tDZI0DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-16 06:46:23 dovecot_plain authenticator failed for (somatonsit) [102.53.15.17]:35734: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:47:11 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2Fd6/atDCqkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:49:22 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<QUdRBaxDAKwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:50:19 host2 sshd[1225617]: Disconnected from invalid user user 2.57.121.25 port 32625 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:51:15 host2 sshd[1226169]: Disconnected from invalid user admin 2.57.121.112 port 62195 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-16 06:51:31 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:35167: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-16 06:51:56 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:43515: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:56:24 host2 sshd[1230470]: Disconnected from invalid user admin 2.57.121.112 port 58890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:57:12 host2 sshd[1230986]: Disconnected from invalid user admin 2.57.121.112 port 62047 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:02:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<MXsuNKxDhq4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:04:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ktl9PKxDXJIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:06:26 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<exJZQqxDtKgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uWYRRqxDFs4DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:46 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rYUXR6xD9oEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:09:24 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0gTtTKxDyIUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.3
country_id: 1269750
description:
Nov 16 07:12:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.3, lip=66.85.158.91, TLS, session=<n+ukVqxDUpBnM98D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.52
country_id: 3469034
description:
Nov 16 07:12:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=170.82.52.52, lip=66.85.158.91, TLS, session=<KC3tV6xDPtmqUjQ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.126
country_id: 3865483
description:
Nov 16 07:13:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.184.226.126, lip=66.85.158.91, TLS, session=<eoDdWKxD4uS+uOJ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.40
country_id: 1269750
description:
Nov 16 07:13:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=45.118.34.40, lip=66.85.158.91, TLS, session=<SUghWqxDTIEtdiIo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:15:58 host2 sshd[1242468]: Disconnected from invalid user ventas05 83.168.78.153 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.151
country_id: 3865483
description:
Nov 16 07:16:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.151, lip=66.85.158.91, TLS, session=<RNNkY6xDppq+tWWX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.85
country_id: 2510769
description:
Nov 16 07:16:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.214.138.85, lip=66.85.158.91, TLS, session=<CWiVZKxDF8251opV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:19:50 host2 sshd[1244621]: Disconnected from invalid user joshua 83.168.78.153 port 44754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:21:03 host2 sshd[1245466]: Disconnected from invalid user lee 83.168.78.153 port 44268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:23:30 host2 sshd[1246843]: Disconnected from invalid user admin 83.168.78.153 port 54360 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:23:31 host2 pure-ftpd[1246874]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:26:14 host2 sshd[1248549]: Disconnected from invalid user rolando 150.230.211.198 port 35150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.103
country_id: 6252001
description:
Nov 16 07:31:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.103, lip=66.85.158.91, TLS, session=<UWVQnaxDYu7N0h9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-16 07:36:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:40254: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-16 07:36:24 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:39607: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:42:34 host2 sshd[1256276]: Disconnected from invalid user no-reply 150.230.211.198 port 40928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:43:56 host2 sshd[1257008]: Disconnected from invalid user action 196.188.120.232 port 58896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Nov 16 07:44:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fQe6y6xDz8uTuYRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:44:57 host2 sshd[1258055]: Disconnected from invalid user newuser 41.33.225.154 port 10055 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.34
country_id: 6251999
description:
Nov 16 07:44:25 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.34, lip=66.85.158.92, session=<JFEoyqxDqspWNh8i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:46:35 host2 sshd[1259051]: Disconnected from invalid user marina 150.230.211.198 port 50598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:46:48 host2 sshd[1259155]: Disconnected from invalid user rstudio 196.188.120.232 port 33290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:48:38 host2 sshd[1260069]: Disconnected from invalid user sysadmin 150.230.211.198 port 51788 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 07:51:58 host2 sshd[1262065]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:52:04 host2 sshd[1262137]: Disconnected from invalid user terraria 196.188.120.232 port 53008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 16 07:51:53 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<Hgzf5KxDNsA2rEyT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:53:50 host2 pure-ftpd[1263050]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:59:36 host2 sshd[1267281]: Disconnected from invalid user sanjay 41.33.225.154 port 39529 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 08:01:47 host2 sshd[1268667]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:04:59 host2 sshd[1271267]: Disconnected from invalid user snq 41.33.225.154 port 9605 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:08:37 host2 sshd[1273842]: Disconnected from invalid user pierre 41.33.225.154 port 33328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-16 08:10:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46626: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-16 08:09:16 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:33264: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.195
country_id: 3175395
description:
Nov 16 08:16:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=171.22.235.195, lip=66.85.158.91, TLS, session=<73UuOq1DA+KrFuvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.251
country_id: 99237
description:
Nov 16 08:16:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=65.20.216.251, lip=66.85.158.91, TLS, session=<vo1MO61Du+RBFNj7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-16 08:19:42 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:59140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-16 08:20:06 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:63804: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:25:08 host2 sshd[1284796]: Disconnected from invalid user bitcoin 45.78.206.234 port 40582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-16 08:26:39 dovecot_plain authenticator failed for (legratobs) [2.55.122.202]:60416: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.204.217.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 151.204.217.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.49
country_id: 6252001
description:
Nov 16 08:30:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.49, lip=66.85.158.92, TLS, session=<mP28b61DYPDG6xgx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 08:32:55 host2 sshd[1288990]: Disconnected from invalid user  2.57.121.112 port 61478 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.222.160.62
country_id: 1880251
description:
Nov 16 08:33:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.222.160.62, lip=66.85.158.91, session=<MlRbeK1DhFMI3qA+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:33:44 host2 sshd[1289385]: Disconnected from invalid user git 89.97.218.142 port 49454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:34:50 host2 sshd[1289879]: Disconnected from invalid user victor 89.97.218.142 port 49476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:36:53 host2 sshd[1291301]: Disconnected from invalid user piyush 89.97.218.142 port 49508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:38:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gw9zjK1Dn8qi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:39:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<TJ7Cj61DJOui2JYK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.108
country_id: 6252001
description:
Nov 16 08:41:43 host2 pure-ftpd[1294023]: (?@64.62.156.108) [INFO] New connection from 64.62.156.108


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:43:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS, session=<2NuLnq1DVOyi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 08:56:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<m/BbzK1Dts42xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 16 08:57:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<gQR2z61DHPLG6xil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 16 08:57:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.12, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Roe60K1DlNWTuYQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 08:58:25 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:58305: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:58:29 host2 sshd[1304381]: Disconnected from invalid user git 45.78.206.234 port 44522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 09:00:43 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, session=<FRgJ261D/Mc2xDDo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Nov 16 09:02:34 host2 pure-ftpd[1306472]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 16 09:09:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<gOZg+a1D6IwD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-16 09:09:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-16 09:09:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47496: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w+IaA65DlJczn+p2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 09:11:34 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:61578: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 pure-ftpd[1312057]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.20
country_id: 798544
description:
Nov 16 09:15:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.228.32.20, lip=66.85.158.91, TLS, session=<9KvxDa5DbOFb5CAU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.54
country_id: 798544
description:
Nov 16 09:15:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=178.216.29.54, lip=66.85.158.91, TLS, session=<CYn5Dq5Dt8qy2B02>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a01:239:213:1900::1
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a01:239:213:1900::1 - yashiholdingscom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.247.137
country_id: 933860
description:
Nov 16 09:23:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.76.247.137, lip=66.85.158.91, TLS, session=<0MClKa5DOdspTPeJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.154.205.93
country_id: 2510769
description:
Nov 16 09:23:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.154.205.93, lip=66.85.158.91, TLS, session=<vkfUKq5D5M65ms1d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 09:27:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59336: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.88
country_id: 3175395
description:
Nov 16 09:34:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.124.182.88, lip=66.85.158.91, TLS, session=<BrHNUq5D6KS5fLZY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.59
country_id: 3175395
description:
Nov 16 09:34:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.208.189.59, lip=66.85.158.91, TLS, session=<oVroU65DvcS50L07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-16 09:42:41 dovecot_login authenticator failed for ([182.75.152.97]) [27.123.111.110]:35772: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
country_id: 2328926
description:
2025-11-16 09:43:00 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:33310: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.215.115.239
country_id: 6252001
description:
[2025-11-16 09:44:53 +0530] info [whostmgrd] 32.215.115.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.34.132.221
country_id: 2802361
description:
Nov 16 09:45:39 host2 pure-ftpd[1328734]: (?@34.34.132.221) [INFO] New connection from 34.34.132.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.34.132.221
country_id: 2802361
description:
Nov 16 09:47:03 host2 pure-ftpd[1329259]: (?@34.34.132.221) [INFO] New connection from 34.34.132.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-11-16 09:48:54 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:60550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-16 09:49:12 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:55213: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:50:46 host2 sshd[1330969]: Disconnected from invalid user webuser 103.52.115.189 port 38958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:51:20 host2 sshd[1331246]: Disconnected from invalid user ymoreno 20.127.224.153 port 53610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-16 09:54:03 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:37842: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 09:54:08 host2 sshd[1332651]: Disconnected from invalid user app 45.78.230.106 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-16 09:54:17 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:32846: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.95
country_id: 798544
description:
Nov 16 09:54:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=109.125.249.95, lip=66.85.158.91, TLS, session=<A4y6m65DpaFtfflf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:55:00 host2 sshd[1333329]: Disconnected from invalid user dci 103.52.115.189 port 46424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.40
country_id: 3469034
description:
Nov 16 09:55:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris>, method=PLAIN, rip=190.89.137.40, lip=66.85.158.91, TLS, session=<qzh/na5DK8C+WYko>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:55:56 host2 sshd[1333988]: Disconnected from invalid user cardano 20.127.224.153 port 55698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:57:54 host2 sshd[1334692]: Disconnected from invalid user cardano 103.52.115.189 port 40378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:59:16 host2 sshd[1335461]: Disconnected from invalid user debian 103.52.115.189 port 39748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:59:40 host2 sshd[1335556]: Disconnected from invalid user andre 20.127.224.153 port 39620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 10:08:48 host2 sshd[1339950]: Disconnected from invalid user app 20.127.224.153 port 49692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 10:09:22 host2 sshd[1340373]: Disconnected from invalid user user 2.57.121.25 port 33363 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 16 10:09:52 host2 sshd[1340645]: Disconnected from invalid user admin 38.137.11.10 port 8182 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 16 10:15:40 host2 sshd[1343763]: Disconnected from invalid user sara 38.137.11.10 port 11228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-16 10:16:34 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:58784: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-16 10:16:52 dovecot_login authenticator failed for ([158.181.132.86]) [158.181.132.86]:35239: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:18:52 host2 sshd[1345160]: Disconnected from invalid user sara 45.78.230.106 port 43020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Nov 16 10:28:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dfjnFK9DxMTG6xjw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.231
country_id: 953987
description:
Nov 16 10:30:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.54.231, lip=66.85.158.91, TLS, session=<+2hqG69DFelmgTbn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.5
country_id: 690791
description:
Nov 16 10:30:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.139.5, lip=66.85.158.91, TLS, session=<fjOlHK9DMZsl3YsF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:32:01 host2 sshd[1352216]: Disconnected from invalid user user 45.78.230.106 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:40:07 host2 sshd[1356028]: Disconnected from invalid user erpnext 45.78.230.106 port 60804 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Nov 16 10:46:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.108, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kFFVVK9DMdTG6xhs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.148
country_id: 953987
description:
Nov 16 10:50:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.47.148, lip=66.85.158.91, TLS, session=<yaXvY69DlaxmQC+U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.203
country_id: 3175395
description:
Nov 16 10:51:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.171.203, lip=66.85.158.91, TLS, session=<2xlDZa9DD5q5D6vL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:51:39 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FDjFZ69DT9wjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:52:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mZSQaa9DmPcjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:53:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Vho9ba9DUvAjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:59:39 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS, session=<g6JmhK9DtOgjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 11:00:56 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS, session=<B1P1iK9Dpusjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 16 11:02:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<l9Atj69D6I5ChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:33:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1Qqm+69D4sADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:33:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<TRxE/K9DSJYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:34:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yfzH/69DNoIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:35:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<KWrfBbBDDogDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:37:08 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<VUdxCrBDJKgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:38:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<En31DbBDdrkDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.131
country_id: 1269750
description:
Nov 16 11:38:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.59.134.131, lip=66.85.158.91, TLS, session=<+yX9DrBDU8dnO4aD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.239.148.142
country_id: 3996063
description:
Nov 16 11:39:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=170.239.148.142, lip=66.85.158.91, TLS, session=<5xY+ELBDb8Wq75SO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:39:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1aTiE7BDcJEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:40:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ClVVFrBDsMwDg9cm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 16 11:41:32 host2 pure-ftpd[1386995]: (?@216.218.206.66) [INFO] New connection from 216.218.206.66


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 16 11:41:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=<JSrFGbBDf9wtQ5ts>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:41:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<mCRNG7BDPKYDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.25
country_id: 3175395
description:
Nov 16 11:42:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.208.189.25, lip=66.85.158.91, TLS, session=<8FndGrBDK8O50L0Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:42:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<U0DFHrBDbpIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 11:55:56 host2 sshd[1394958]: Disconnected from invalid user yusuf 2.57.121.112 port 61331 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 12:01:50 host2 sshd[1397609]: Disconnected from invalid user yusuf 2.57.121.112 port 63124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Nov 16 12:26:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.105, lip=66.85.158.91, session=<YQQbu7BDVOPN0h9p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.2.199
country_id: 953987
description:
Nov 16 12:26:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.66.2.199, lip=66.85.158.91, TLS, session=<O1courBDX7hmQgLH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.66.114.45
country_id: 1269750
description:
Nov 16 12:26:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.66.114.45, lip=66.85.158.91, TLS, session=<+iF6u7BDG4tnQnIt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.47.228.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.47.228.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.122
country_id: 1819730
description:
Nov 16 12:45:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.122, lip=66.85.158.92, session=<P5wf/bBDgtEtjpp6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.208.138.112
country_id: 2750405
description:
Nov 16 12:48:10 host2 pure-ftpd[1419075]: (?@87.208.138.112) [INFO] New connection from 87.208.138.112


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov 16 12:50:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<SL+VEbFDcDmnXpI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 16 12:54:40 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<K+a0H7FDSr4D7a3c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.230.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.150.230.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 13:05:20 host2 sshd[1428445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 13:08:03 host2 sshd[1429632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 13:08:33 host2 sshd[1429849]: Disconnected from invalid user joana 62.60.131.157 port 18641 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.100
country_id: 953987
description:
Nov 16 13:10:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.52.100, lip=66.85.158.91, TLS, session=<Xz7cWLFDiaZmgTRk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.102
country_id: 1269750
description:
Nov 16 13:11:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.246.170.102, lip=66.85.158.91, TLS, session=<IgAcWrFDXYNn9qpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 13:12:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63559: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.234
country_id: 6252001
description:
Nov 16 13:15:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xfY8abFD08LG6xjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-16 13:28:46 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:41338: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-16 13:29:00 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36059: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 13:32:06 host2 sshd[1440755]: Disconnected from invalid user user 2.57.121.25 port 24843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Nov 16 13:36:14 host2 sshd[1442698]: Disconnected from invalid user user 209.141.33.240 port 57794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:37:20 host2 sshd[1443177]: Disconnected from invalid user vivek 35.200.237.19 port 1106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 16 13:36:45 host2 sshd[1442915]: Disconnected from invalid user test1 132.145.213.106 port 51212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov 16 13:36:57 host2 sshd[1442989]: Disconnected from invalid user dev 167.172.43.167 port 33906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:37:19 host2 sshd[1443170]: Disconnected from invalid user god 194.102.104.110 port 46696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Nov 16 13:37:36 host2 sshd[1443286]: Disconnected from invalid user test1 192.227.214.205 port 41344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 16 13:38:08 host2 sshd[1443530]: Disconnected from invalid user deployer 107.172.155.3 port 37142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:37:45 host2 sshd[1443359]: Disconnected from invalid user dev 20.185.243.158 port 41278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 16 13:38:55 host2 sshd[1443864]: Disconnected from invalid user jai 64.227.176.54 port 41724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 16 13:39:02 host2 sshd[1443989]: Disconnected from invalid user test1 34.58.124.191 port 39642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.78.171.114
country_id: 1269750
description:
Nov 16 13:39:06 host2 sshd[1444011]: Disconnected from invalid user znc 103.78.171.114 port 36440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:39:21 host2 sshd[1444120]: Disconnected from invalid user user1 50.232.189.209 port 57492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Nov 16 13:38:32 host2 sshd[1443665]: Disconnected from invalid user test1 117.216.143.31 port 56240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:39:17 host2 sshd[1444084]: Disconnected from invalid user cmm 167.71.226.156 port 40924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.99.171.3
country_id: 6251999
description:
Nov 16 13:38:53 host2 sshd[1443860]: Disconnected from invalid user moein 50.99.171.3 port 55134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:38:29 host2 sshd[1443647]: Disconnected from invalid user r00t 85.185.120.213 port 53572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 13:39:51 host2 sshd[1444340]: Disconnected from invalid user testuser 64.225.0.78 port 60824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 16 13:40:05 host2 sshd[1444611]: Disconnected from invalid user god 102.211.152.138 port 42158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov 16 13:39:33 host2 sshd[1444199]: Disconnected from invalid user user1 103.49.238.251 port 50648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 16 13:39:37 host2 sshd[1444223]: Disconnected from invalid user test1 104.168.117.131 port 39430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 16 13:40:02 host2 sshd[1444419]: Disconnected from invalid user xx 103.52.115.25 port 58312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 16 13:39:56 host2 sshd[1444363]: Disconnected from invalid user ftpusr 185.50.38.171 port 55676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Nov 16 13:40:08 host2 sshd[1444629]: Disconnected from invalid user postgres 159.223.37.230 port 34200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Nov 16 13:40:19 host2 sshd[1444768]: Disconnected from invalid user vivek 116.71.136.125 port 48996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.114
country_id: 953987
description:
Nov 16 13:40:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.129.54.114, lip=66.85.158.91, TLS, session=<34wlwrFDq7hmgTZy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 16 13:40:10 host2 sshd[1444662]: Disconnected from invalid user user1 46.20.111.2 port 35782 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 16 13:41:09 host2 sshd[1445517]: Disconnected from invalid user testuser 132.145.213.106 port 36094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:40:28 host2 sshd[1444960]: Disconnected from invalid user ftpusr 20.185.243.158 port 52282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.31
country_id: 3469034
description:
Nov 16 13:40:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=201.159.85.31, lip=66.85.158.91, TLS, session=<Qy9mw7FD5aXJn1Uf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.218.138
country_id: 130758
description:
Nov 16 13:40:43 host2 sshd[1445200]: Disconnected from invalid user postgres 62.60.218.138 port 41104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 16 13:40:58 host2 sshd[1445387]: Disconnected from invalid user r00t 198.144.176.83 port 39296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 16 13:41:20 host2 sshd[1445633]: Disconnected from invalid user testuser 20.102.116.25 port 46884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:40:48 host2 sshd[1445247]: Disconnected from invalid user deployer 194.102.104.110 port 41624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Nov 16 13:40:42 host2 sshd[1445191]: Disconnected from invalid user testuser 103.243.26.174 port 60280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov 16 13:40:54 host2 sshd[1445339]: Disconnected from invalid user postgres 185.116.160.35 port 39220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.229.250
country_id: 1880251
description:
Nov 16 13:42:27 host2 sshd[1446332]: Disconnected from invalid user xx 139.59.229.250 port 47354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 16 13:41:40 host2 sshd[1445813]: Disconnected from invalid user u2 104.223.85.124 port 54296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 16 13:41:44 host2 sshd[1445845]: Disconnected from invalid user hb 164.92.106.89 port 36318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:42:00 host2 sshd[1446035]: Disconnected from invalid user chromeuser 202.74.239.125 port 60062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 16 13:42:08 host2 sshd[1446159]: Disconnected from invalid user postgres 185.213.164.17 port 43970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Nov 16 13:42:17 host2 sshd[1446251]: Disconnected from invalid user damian 186.118.142.216 port 34634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Nov 16 13:41:53 host2 sshd[1445967]: Disconnected from invalid user ftpusr 152.42.231.101 port 58108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 16 13:42:25 host2 sshd[1446316]: Disconnected from invalid user test1 185.164.73.248 port 35944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Nov 16 13:42:02 host2 sshd[1446114]: Disconnected from invalid user chromeuser 64.227.174.243 port 46602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 16 13:43:07 host2 sshd[1446742]: Disconnected from invalid user intelbras 46.20.111.2 port 40470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Nov 16 13:43:07 host2 sshd[1446751]: Disconnected from invalid user god 138.68.104.233 port 56870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.42.207.17
country_id: 3175395
description:
Nov 16 13:43:25 host2 sshd[1446884]: Disconnected from invalid user znc 2.42.207.17 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Nov 16 13:42:32 host2 sshd[1446397]: Disconnected from invalid user hb 24.199.117.9 port 46508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Nov 16 13:42:37 host2 sshd[1446426]: Disconnected from invalid user postgres 103.189.235.176 port 37412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.162
country_id: 130758
description:
Nov 16 13:42:50 host2 sshd[1446527]: Disconnected from invalid user dev 94.184.18.162 port 18256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 16 13:42:59 host2 sshd[1446618]: Disconnected from invalid user god 107.175.70.59 port 59868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Nov 16 13:43:11 host2 sshd[1446783]: Disconnected from invalid user postgres 196.189.155.89 port 37748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Nov 16 13:42:52 host2 sshd[1446546]: Disconnected from invalid user user 95.128.196.243 port 51556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov 16 13:43:13 host2 sshd[1446794]: Disconnected from invalid user fivem 157.10.252.119 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.144
country_id: 1269750
description:
Nov 16 13:43:27 host2 sshd[1446917]: Disconnected from invalid user hb 64.227.160.144 port 44226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.188.221
country_id: 1269750
description:
Nov 16 13:42:29 host2 sshd[1446340]: Disconnected from invalid user emo 165.232.188.221 port 52518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 16 13:42:56 host2 sshd[1446608]: Disconnected from invalid user branch 165.227.32.198 port 39104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Nov 16 13:43:04 host2 sshd[1446724]: Disconnected from invalid user hb 52.250.16.220 port 58310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.100.188
country_id: 6252001
description:
Nov 16 13:43:23 host2 sshd[1446880]: Disconnected from invalid user testuser 144.172.100.188 port 49456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:43:09 host2 sshd[1446756]: Disconnected from invalid user xx 125.21.53.232 port 45126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:43:19 host2 sshd[1446852]: Disconnected from invalid user jayanthi 139.59.91.254 port 60896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 16 13:43:42 host2 sshd[1447083]: Disconnected from invalid user znc 40.117.97.0 port 37396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Nov 16 13:44:04 host2 sshd[1447344]: Disconnected from invalid user jai 103.193.176.131 port 58080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.129.56
country_id: 1269750
description:
Nov 16 13:44:14 host2 sshd[1447634]: Disconnected from invalid user flavia 64.227.129.56 port 58712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:43:32 host2 sshd[1446984]: Disconnected from invalid user jayanthi 185.126.7.35 port 57340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:44:11 host2 sshd[1447484]: Disconnected from invalid user test1 185.158.23.150 port 29165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Nov 16 13:43:53 host2 sshd[1447161]: Disconnected from invalid user branch 152.42.165.179 port 55738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.152.40
country_id: 6252001
description:
Nov 16 13:44:23 host2 sshd[1448046]: Disconnected from invalid user znc 178.128.152.40 port 37382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:45:25 host2 sshd[1448906]: Disconnected from invalid user cmm 194.102.104.110 port 36614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Nov 16 13:44:30 host2 sshd[1448143]: Disconnected from invalid user testuser 209.141.33.240 port 59736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.191.132
country_id: 130758
description:
Nov 16 13:44:45 host2 sshd[1448267]: Disconnected from invalid user test1 37.152.191.132 port 37284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:44:54 host2 sshd[1448378]: Disconnected from invalid user branch 94.139.191.44 port 55274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Nov 16 13:45:07 host2 sshd[1448680]: Disconnected from invalid user u2 209.141.47.217 port 34770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Nov 16 13:45:26 host2 sshd[1448917]: Disconnected from invalid user test1 192.81.208.35 port 34244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:44:48 host2 sshd[1448315]: Disconnected from invalid user damian 202.74.239.125 port 45418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:44:29 host2 sshd[1448116]: Disconnected from invalid user postgres 139.59.91.254 port 49800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.61.221.48
country_id: 290557
description:
Nov 16 13:44:42 host2 sshd[1448248]: Disconnected from invalid user cmm 179.61.221.48 port 59202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:45:03 host2 sshd[1448548]: Disconnected from invalid user postgres 185.158.23.150 port 52811 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov 16 13:44:35 host2 sshd[1448195]: Disconnected from invalid user vivek 157.10.252.119 port 46356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.217.189
country_id: 1269750
description:
Nov 16 13:45:55 host2 sshd[1449307]: Disconnected from invalid user moein 103.183.217.189 port 58644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Nov 16 13:46:05 host2 sshd[1449546]: Disconnected from invalid user fivem 103.193.176.131 port 58186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:46:09 host2 sshd[1449598]: Disconnected from invalid user user 192.155.91.167 port 57376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov 16 13:46:09 host2 sshd[1449593]: Disconnected from invalid user user 159.89.161.111 port 32904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.152.40
country_id: 6252001
description:
Nov 16 13:45:28 host2 sshd[1448933]: Disconnected from invalid user postgres 178.128.152.40 port 35522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.55.216
country_id: 1880251
description:
Nov 16 13:45:56 host2 sshd[1449329]: Disconnected from invalid user god 178.128.55.216 port 40396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-16 13:46:23 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:38723: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.193.167
country_id: 6252001
description:
Nov 16 13:45:35 host2 sshd[1449169]: Disconnected from invalid user r00t 134.199.193.167 port 58640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Nov 16 13:45:59 host2 sshd[1449403]: Disconnected from invalid user branch 23.95.37.90 port 52584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:45:44 host2 sshd[1449223]: Disconnected from invalid user postgres 125.21.53.232 port 45022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Nov 16 13:46:03 host2 sshd[1449470]: Disconnected from invalid user admin 103.49.239.184 port 45636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:45:36 host2 sshd[1449161]: Disconnected from invalid user dev 185.126.7.35 port 57250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov 16 13:45:50 host2 sshd[1449264]: Disconnected from invalid user cmm 185.50.38.231 port 40724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:45:39 host2 sshd[1449192]: Disconnected from invalid user testuser 139.59.91.254 port 41088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 16 13:46:18 host2 sshd[1449721]: Disconnected from invalid user jayanthi 20.102.116.25 port 54432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 16 13:46:03 host2 sshd[1449534]: Disconnected from invalid user deployer 165.227.32.198 port 50722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Nov 16 13:46:04 host2 sshd[1449537]: Disconnected from invalid user chromeuser 103.49.238.51 port 59968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 16 13:46:21 host2 sshd[1449800]: Disconnected from invalid user ftpusr 51.222.206.109 port 38778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-16 13:46:43 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:58084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov 16 13:46:51 host2 sshd[1450121]: Disconnected from invalid user u2 146.190.111.235 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 16 13:47:21 host2 sshd[1450576]: Disconnected from invalid user moein 104.223.85.124 port 42430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:46:43 host2 sshd[1450050]: Disconnected from invalid user cmm 185.158.23.150 port 46774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:47:07 host2 sshd[1450390]: Disconnected from invalid user r00t 20.185.243.158 port 47706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:46:47 host2 sshd[1450071]: Disconnected from invalid user user 139.59.91.254 port 40152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.193.167
country_id: 6252001
description:
Nov 16 13:46:40 host2 sshd[1450031]: Disconnected from invalid user znc 134.199.193.167 port 45754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Nov 16 13:47:22 host2 sshd[1450579]: Disconnected from invalid user znc 102.211.152.28 port 57398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:47:30 host2 sshd[1450640]: Disconnected from invalid user r00t 185.158.23.150 port 48118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.200.45.164
country_id: 6252001
description:
Nov 16 13:47:44 host2 sshd[1450906]: Disconnected from invalid user test 198.200.45.164 port 36402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Nov 16 13:47:35 host2 sshd[1450749]: Disconnected from invalid user test1 59.97.205.137 port 30757 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 16 13:47:51 host2 sshd[1451015]: Disconnected from invalid user testuser 107.175.70.59 port 44412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.100.188
country_id: 6252001
description:
Nov 16 13:47:35 host2 sshd[1450770]: Disconnected from invalid user postgres 144.172.100.188 port 42822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov 16 13:48:23 host2 sshd[1451395]: Disconnected from invalid user test1 159.89.161.111 port 44254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov 16 13:47:28 host2 sshd[1450629]: Disconnected from invalid user postgres 159.223.183.233 port 54358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 16 13:49:16 host2 sshd[1452085]: Disconnected from invalid user testuser 103.52.115.25 port 35702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:49:17 host2 sshd[1452090]: Disconnected from invalid user cmm 125.21.53.232 port 39144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 16 13:48:47 host2 sshd[1451710]: Disconnected from invalid user user 185.164.73.248 port 43542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Nov 16 13:48:34 host2 sshd[1451572]: Disconnected from invalid user postgres 64.227.134.24 port 58544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Nov 16 13:48:52 host2 sshd[1451781]: Disconnected from invalid user postgres 138.68.104.233 port 35282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.41.223
country_id: 1880251
description:
Nov 16 13:49:13 host2 sshd[1452065]: Disconnected from invalid user postgres 157.230.41.223 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Nov 16 13:48:45 host2 sshd[1451671]: Disconnected from invalid user testuser 37.152.174.44 port 47436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:48:46 host2 sshd[1451685]: Disconnected from invalid user test1 85.185.120.213 port 43244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Nov 16 13:48:33 host2 sshd[1451568]: Disconnected from invalid user dev 154.113.10.113 port 60488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.58.36
country_id: 1880251
description:
Nov 16 13:48:57 host2 sshd[1451851]: Disconnected from invalid user postgres 178.128.58.36 port 51520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.44.227
country_id: 2635167
description:
Nov 16 13:49:21 host2 sshd[1452149]: Disconnected from invalid user u2 64.227.44.227 port 45746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:48:42 host2 sshd[1451649]: Disconnected from invalid user odoo 27.112.78.170 port 58676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Nov 16 13:48:28 host2 sshd[1451442]: Disconnected from invalid user admin 34.93.128.179 port 45122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:49:07 host2 sshd[1452014]: Disconnected from invalid user flavia 50.232.189.209 port 35006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Nov 16 13:50:04 host2 sshd[1452892]: Disconnected from invalid user admin 64.227.139.157 port 40208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov 16 13:50:23 host2 sshd[1453237]: Disconnected from invalid user znc 185.116.160.35 port 38400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.188.240.152
country_id: 1269750
description:
Nov 16 13:50:15 host2 sshd[1453137]: Disconnected from invalid user ftpusr 4.188.240.152 port 49194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 16 13:50:07 host2 sshd[1452970]: Disconnected from invalid user odoo 64.227.176.54 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:49:51 host2 sshd[1452607]: Disconnected from invalid user postgres 85.185.120.213 port 46928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Nov 16 13:49:27 host2 sshd[1452224]: Disconnected from invalid user intelbras 20.255.62.58 port 35310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 16 13:49:36 host2 sshd[1452370]: Disconnected from invalid user dev 103.224.247.23 port 36862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.144
country_id: 1269750
description:
Nov 16 13:49:39 host2 sshd[1452411]: Disconnected from invalid user admin 64.227.160.144 port 53948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.141
country_id: 953987
description:
Nov 16 13:50:17 host2 sshd[1453155]: Disconnected from invalid user ftpusr 102.210.149.141 port 45520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 16 13:50:46 host2 sshd[1453619]: Disconnected from invalid user znc 34.58.124.191 port 44296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Nov 16 13:51:16 host2 sshd[1454151]: Disconnected from invalid user cmm 154.113.10.113 port 37274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.117.150
country_id: 1819730
description:
Nov 16 13:50:44 host2 sshd[1453602]: Disconnected from invalid user postgres 185.216.117.150 port 41494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 16 13:51:17 host2 sshd[1454156]: Disconnected from invalid user test1 185.50.38.171 port 58386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.95.92
country_id: 1512440
description:
Nov 16 13:51:23 host2 sshd[1454236]: Disconnected from invalid user postgres 89.39.95.92 port 41700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:50:34 host2 sshd[1453508]: Disconnected from invalid user jai 202.74.239.125 port 41340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.202
country_id: 1269750
description:
Nov 16 13:50:33 host2 sshd[1453502]: Disconnected from invalid user user 40.81.224.202 port 46153 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Nov 16 13:50:56 host2 sshd[1453756]: Disconnected from invalid user user 103.30.41.231 port 36992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.162
country_id: 130758
description:
Nov 16 13:51:05 host2 sshd[1453968]: Disconnected from invalid user testuser 94.184.18.162 port 19058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 16 13:50:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<xg3M57FDeKWUcdUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.159
country_id: 6252001
description:
Nov 16 13:51:07 host2 sshd[1454037]: Disconnected from invalid user postgres 199.195.251.159 port 52060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 16 13:52:03 host2 sshd[1454702]: Disconnected from invalid user testuser 103.59.94.62 port 33696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 16 13:52:17 host2 sshd[1454986]: Disconnected from invalid user user1 20.253.214.172 port 59686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:52:22 host2 sshd[1455027]: Disconnected from invalid user user1 27.112.78.170 port 45838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov 16 13:51:29 host2 sshd[1454279]: Disconnected from invalid user god 146.190.111.235 port 45720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Nov 16 13:52:24 host2 sshd[1455060]: Disconnected from invalid user testtest 203.150.162.250 port 37964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Nov 16 13:51:36 host2 sshd[1454360]: Disconnected from invalid user user 40.81.244.142 port 54322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.55.216
country_id: 1880251
description:
Nov 16 13:52:11 host2 sshd[1454838]: Disconnected from invalid user znc 178.128.55.216 port 54178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:51:41 host2 sshd[1454428]: Disconnected from invalid user branch 185.126.7.35 port 50576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:51:47 host2 sshd[1454492]: Disconnected from invalid user postgres 167.71.226.156 port 49964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Nov 16 13:51:51 host2 sshd[1454556]: Disconnected from invalid user xx 195.158.4.216 port 59944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:52:51 host2 sshd[1455362]: Disconnected from invalid user odoo 35.200.237.19 port 1139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:53:23 host2 sshd[1455871]: Disconnected from invalid user postgres 157.245.49.180 port 59666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:52:38 host2 sshd[1455234]: Disconnected from invalid user runner 50.232.189.209 port 33982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Nov 16 13:52:56 host2 sshd[1455442]: Disconnected from invalid user branch 103.243.26.174 port 41126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.146
country_id: 1643084
description:
Nov 16 13:53:01 host2 sshd[1455521]: Disconnected from invalid user runner 103.76.120.146 port 37490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Nov 16 13:53:13 host2 sshd[1455751]: Disconnected from invalid user cmm 103.30.41.231 port 39264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 13:53:21 host2 sshd[1455852]: Disconnected from invalid user abhinav 45.78.205.7 port 54680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.252.95.146
country_id: 1210997
description:
Nov 16 13:53:34 host2 sshd[1455979]: Disconnected from invalid user flavia 182.252.95.146 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:54:14 host2 sshd[1456777]: Disconnected from invalid user damian 27.112.78.170 port 44230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.141
country_id: 953987
description:
Nov 16 13:54:16 host2 sshd[1456838]: Disconnected from invalid user postgres 102.210.149.141 port 55222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:54:19 host2 sshd[1456923]: Disconnected from invalid user jai 35.200.237.19 port 1118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.13.244.219
country_id: 3686110
description:
Nov 16 13:54:22 host2 sshd[1457009]: Disconnected from invalid user test 200.13.244.219 port 39796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Nov 16 13:53:49 host2 sshd[1456115]: Disconnected from invalid user jai 103.49.239.184 port 58894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov 16 13:54:28 host2 sshd[1457102]: Disconnected from invalid user hb 103.49.238.251 port 52926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Nov 16 13:54:05 host2 sshd[1456486]: Disconnected from invalid user odoo 128.199.168.119 port 51078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Nov 16 13:53:36 host2 sshd[1455998]: Disconnected from invalid user testuser 158.69.210.167 port 58866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.129.56
country_id: 1269750
description:
Nov 16 13:53:28 host2 sshd[1455907]: Disconnected from invalid user admin 64.227.129.56 port 48434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 13:54:36 host2 sshd[1457205]: Disconnected from invalid user cmm 137.184.86.31 port 51222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:55:11 host2 sshd[1457626]: Disconnected from invalid user cmm 94.139.191.44 port 56184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Nov 16 13:54:41 host2 sshd[1457248]: Disconnected from invalid user damian 203.150.162.250 port 52578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:55:18 host2 sshd[1457722]: Disconnected from invalid user u2 157.245.49.180 port 52996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:56:24 host2 sshd[1458443]: Disconnected from invalid user testuser 94.139.191.44 port 56284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Nov 16 13:55:42 host2 sshd[1457932]: Disconnected from invalid user znc 68.183.82.237 port 46490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Nov 16 13:55:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.92, TLS, session=<tFgQ+rFDDvDN0h8m>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:56:42 host2 sshd[1458600]: Disconnected from invalid user testuser 192.155.91.167 port 40732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.13.244.219
country_id: 3686110
description:
Nov 16 13:56:40 host2 sshd[1458584]: Disconnected from invalid user intelbras 200.13.244.219 port 47472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.183.138
country_id: 1880251
description:
Nov 16 13:56:57 host2 sshd[1458684]: Disconnected from invalid user testtest 128.199.183.138 port 51310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Nov 16 13:57:31 host2 sshd[1458999]: Disconnected from invalid user moein 192.227.214.205 port 33948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:57:45 host2 sshd[1459182]: Disconnected from invalid user jayanthi 192.155.91.167 port 60490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 13:58:05 host2 sshd[1459398]: Disconnected from invalid user moein 137.184.86.31 port 49882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:57:49 host2 sshd[1459212]: Disconnected from invalid user u2 167.71.226.156 port 38700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:59:05 host2 sshd[1459861]: Disconnected from invalid user cmm 157.245.49.180 port 33828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.242.142
country_id: 6251999
description:
Nov 16 13:58:27 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.190.242.142, lip=66.85.158.91, TLS, session=<v2rUA7JDgqySvvKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.58.36
country_id: 1880251
description:
Nov 16 13:58:34 host2 sshd[1459613]: Disconnected from invalid user moein 178.128.58.36 port 40768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 14:00:18 host2 sshd[1460779]: Disconnected from invalid user dev 64.225.0.78 port 35488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 14:00:17 host2 sshd[1460741]: Disconnected from invalid user student3 45.78.205.7 port 48552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:01:55 host2 sshd[1461695]: Disconnected from invalid user jjq 203.150.107.244 port 53282 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 14:03:18 host2 sshd[1462771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:03:38 host2 sshd[1462978]: Disconnected from invalid user steam 177.229.197.38 port 46752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 14:03:58 host2 sshd[1463097]: Disconnected from invalid user u2 64.225.0.78 port 56936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:04:58 host2 sshd[1463620]: Disconnected from invalid user librenms 177.229.197.38 port 57004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-11-16 14:05:40 dovecot_login authenticator failed for ([223.25.94.211]) [223.25.94.211]:60723: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.30
country_id: 2186224
description:
2025-11-16 14:06:04 dovecot_login authenticator failed for ([121.73.168.30]) [121.73.168.30]:54966: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-16 14:06:23 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:56300: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:06:16 host2 sshd[1464560]: Disconnected from invalid user user 177.229.197.38 port 52490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:07:33 host2 sshd[1465255]: Disconnected from invalid user db2inst1 203.150.107.244 port 52038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:08:56 host2 sshd[1465887]: Disconnected from invalid user adminftp 203.150.107.244 port 51728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 14:10:30 host2 sshd[1466880]: Disconnected from invalid user jayanthi 137.184.86.31 port 43018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:10:51 host2 sshd[1467144]: Disconnected from invalid user dev 159.203.118.58 port 45592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.95.92
country_id: 1512440
description:
Nov 16 14:12:43 host2 sshd[1468134]: Disconnected from invalid user cmm 89.39.95.92 port 38150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 14:13:48 host2 sshd[1468686]: Disconnected from invalid user light 45.78.205.7 port 51814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:14:51 host2 sshd[1469185]: Disconnected from invalid user digital 159.203.118.58 port 54184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.201
country_id: 1269750
description:
Nov 16 14:15:27 host2 sshd[1469603]: Disconnected from invalid user testuser 40.81.224.201 port 42493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.160
country_id: 1269750
description:
Nov 16 14:16:54 host2 sshd[1470549]: Disconnected from invalid user r00t 40.81.224.160 port 29566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:16:56 host2 sshd[1470585]: Disconnected from invalid user centos 159.203.118.58 port 43362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.203
country_id: 1269750
description:
Nov 16 14:18:19 host2 sshd[1471279]: Disconnected from invalid user moein 40.81.224.203 port 58546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-11-16 14:18:42 dovecot_login authenticator failed for ([82.102.149.88]) [82.102.149.88]:51633: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-11-16 14:18:56 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:36973: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.203
country_id: 1269750
description:
Nov 16 14:19:46 host2 sshd[1471867]: Disconnected from invalid user deployer 40.81.224.203 port 51725 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:20:53 host2 sshd[1472571]: Disconnected from invalid user bigdata 159.203.118.58 port 54924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.160
country_id: 1269750
description:
Nov 16 14:22:45 host2 sshd[1473603]: Disconnected from invalid user dev 40.81.224.160 port 27054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-11-16 14:27:01 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:57050: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-16 14:26:38 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:36424: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-16 14:28:05 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:56482: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-11-16 14:28:22 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:37412: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Nov 16 14:36:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.92, session=<zcyVi7JDsPnG6xjT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-16 14:42:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:37910: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.38.133.146
country_id: 2750405
description:
2025-11-16 14:46:06 dovecot_login authenticator failed for (RZgI8DL) [84.38.133.146]:54153: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.38.133.146
country_id: 2750405
description:
2025-11-16 14:46:43 dovecot_login authenticator failed for (1ZGM6RJU) [84.38.133.146]:54166: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.21.238.137
country_id: 2782113
description:
Nov 16 14:48:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=185.21.238.137, lip=66.85.158.91, TLS, session=<P2LdtLJDTLq5Fe6J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.114
country_id: 3469034
description:
Nov 16 14:47:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.114, lip=66.85.158.91, TLS, session=<8rKds7JDyNm7eEly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.49.152.114
country_id: 3996063
description:
Nov 16 15:17:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=38.49.152.114, lip=66.85.158.91, TLS, session=<0H3CG7NDp9AmMZhy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.144.246.132
country_id: 798544
description:
Nov 16 15:17:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.144.246.132, lip=66.85.158.91, TLS, session=<HVTQHLNDseS5kPaE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 15:18:08 host2 sshd[1505548]: Disconnected from invalid user admin 2.57.121.112 port 61776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 15:23:52 host2 sshd[1508996]: Disconnected from invalid user admin 2.57.121.112 port 62185 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 16 15:26:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, TLS: Connection closed, session=<UE01PrNDhEWnXpI2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:37:52 host2 sshd[1517221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:44:34 host2 sshd[1521706]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:44:09 host2 sshd[1521133]: Disconnected from invalid user master 95.0.27.163 port 52132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-16 15:45:32 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:36066: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-16 15:45:53 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:11004: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:46:23 host2 sshd[1522694]: Disconnected from invalid user cacti 117.247.111.70 port 34603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:47:17 host2 sshd[1523114]: Disconnected from invalid user rustserver 95.0.27.163 port 56818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:48:33 host2 sshd[1523673]: Disconnected from invalid user sangoma 95.0.27.163 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:49:31 host2 sshd[1524078]: Disconnected from invalid user venkatesh 117.247.111.70 port 55398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:49:49 host2 sshd[1524207]: Disconnected from invalid user master 155.4.244.107 port 28473 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:51:04 host2 sshd[1525094]: Disconnected from invalid user server 95.0.27.163 port 47110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:52:24 host2 sshd[1525769]: Disconnected from invalid user ops 95.0.27.163 port 52186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:52:36 host2 sshd[1525852]: Disconnected from invalid user sujan 117.247.111.70 port 18261 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.75.218
country_id: 1269750
description:
Nov 16 15:53:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.255.75.218, lip=66.85.158.91, TLS, session=<CdMInbNDBrtn/0va>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.158
country_id: 798544
description:
Nov 16 15:53:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=46.227.39.158, lip=66.85.158.91, TLS, session=<8qomnrNDdesu4yee>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:54:22 host2 sshd[1527216]: Disconnected from invalid user user1 155.4.244.107 port 13034 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:55:36 host2 sshd[1528385]: Disconnected from invalid user larry 117.247.111.70 port 51794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.71
country_id: 3469034
description:
Nov 16 15:56:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.44.71.71, lip=66.85.158.91, TLS, session=<9NysqLNDrtuxLEdH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.62
country_id: 3175395
description:
Nov 16 15:56:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.208.106.62, lip=66.85.158.91, TLS, session=<7n/nqbNDXMW50Go+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:57:23 host2 sshd[1529322]: Disconnected from invalid user hung 155.4.244.107 port 18892 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:58:47 host2 sshd[1530094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 16 15:59:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=</EVktLNDZtkDU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 16:00:52 host2 sshd[1531423]: Disconnected from invalid user librenms 155.4.244.107 port 4534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.32.39
country_id: 6252001
description:
Nov 16 16:00:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.118.32.39, lip=66.85.158.91, TLS, session=<dYtit7NDmsEUdiAn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-16 16:03:13 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:48172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-11-16 16:06:52 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:45322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-16 16:07:40 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38016: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 16:31:00 host2 sshd[1549468]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:30:29 host2 sshd[1549244]: Disconnected from invalid user ict 157.230.85.50 port 39134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.180.92
country_id: 6252001
description:
Nov 16 16:30:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.180.92, lip=66.85.158.92, TLS, session=<FsFTJbRD1sUofLRc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:32:50 host2 sshd[1550463]: Disconnected from invalid user rajesh 157.230.85.50 port 55238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:35:15 host2 sshd[1551942]: Disconnected from invalid user devops 157.230.85.50 port 53320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:36:26 host2 sshd[1552672]: Disconnected from invalid user admin 157.230.85.50 port 56810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:38:44 host2 sshd[1553847]: Disconnected from invalid user reza 157.230.85.50 port 50844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.228.161.66
country_id: 1327865
description:
Nov 16 16:44:29 host2 sshd[1557679]: Disconnected from invalid user dtl 136.228.161.66 port 36340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 16:47:58 host2 sshd[1559982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-16 16:53:06 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:38669: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 16:53:11 host2 sshd[1563269]: Disconnected from invalid user ict 107.173.10.98 port 1174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-16 16:53:12 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38318: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 16:59:15 host2 sshd[1567755]: Disconnected from invalid user devops 107.173.10.98 port 22132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.10
country_id: 2510769
description:
Nov 16 17:04:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.53.36.10, lip=66.85.158.91, TLS, session=<3lytnLRDCofDNSQK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.182
country_id: 953987
description:
Nov 16 17:05:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.42.182, lip=66.85.158.91, TLS, session=<L4DRnbRDP4dmQCq2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 17:07:26 host2 sshd[1573047]: Disconnected from invalid user lord 107.173.10.98 port 34538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 17:07:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56230: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.24
country_id: 1269750
description:
Nov 16 17:15:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=103.18.166.24, lip=66.85.158.91, TLS, session=<sNcHxLRDX7JnEqYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.8
country_id: 3175395
description:
Nov 16 17:15:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=171.22.235.8, lip=66.85.158.91, TLS, session=<ZG7hwrRDutSrFusI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.146
country_id: 3865483
description:
Nov 16 17:22:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.122.133.146, lip=66.85.158.91, TLS, session=<JvHk3bRDWra+eoWS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.51
country_id: 719819
description:
Nov 16 17:23:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=178.48.181.51, lip=66.85.158.91, TLS, session=<FioT37RDXoeyMLUz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.6.200.134
country_id: 3469034
description:
Nov 16 17:24:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=45.6.200.134, lip=66.85.158.91, TLS, session=<DqtV5bRD+sUtBsiG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 17:25:07 host2 sshd[1585012]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.133.120
country_id: 1269750
description:
Nov 16 17:25:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.59.133.120, lip=66.85.158.91, TLS, session=<NjKD5rRDLNJnO4V4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:29:35 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<kPXp9rRDep8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:33:05 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<05xsA7VD2ugDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-16 17:32:20 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:52048: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:33:13 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<0ZLdA7VD7KoDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:01 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<nS++BrVDXoEDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:07 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<W1kYB7VD/LQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<vVNqB7VD4qQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:36:24 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<WJA9D7VD8oEDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.77
country_id: 3175395
description:
Nov 16 17:36:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.70.204.77, lip=66.85.158.91, TLS, session=<6IP/DrVD7uJtRsxN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.154
country_id: 3175395
description:
Nov 16 17:36:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.77.51.154, lip=66.85.158.91, TLS, session=<cijzDbVDIOe5TTOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.115.146
country_id: 3865483
description:
Nov 16 17:46:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=190.110.115.146, lip=66.85.158.91, TLS, session=<ObHIMLVD4au+bnOS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.139.72
country_id: 3469034
description:
Nov 16 17:45:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=201.55.139.72, lip=66.85.158.91, TLS, session=<Vu1fL7VD19fJN4tI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.27
country_id: 798544
description:
Nov 16 17:46:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.216.29.27, lip=66.85.158.91, TLS, session=<iQ30MrVD+Miy2B0b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.20.230.22
country_id: 3469034
description:
Nov 16 17:47:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=177.20.230.22, lip=66.85.158.91, TLS, session=</lBvNLVDDuuxFOYW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.241.243.20
country_id: 1269750
description:
Nov 16 17:48:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.241.243.20, lip=66.85.158.91, TLS, session=<9VkMOLVDl5dn8fMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.28
country_id: 798544
description:
Nov 16 17:48:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<587hr>, method=PLAIN, rip=178.216.29.28, lip=66.85.158.91, TLS, session=<T8KWObVDZYmy2B0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:49:09 host2 sshd[1602057]: Disconnected from invalid user eun 162.223.91.130 port 56600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:50:43 host2 sshd[1603586]: Disconnected from invalid user java 162.223.91.130 port 33690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:53:08 host2 sshd[1605417]: Disconnected from invalid user leonardo 162.223.91.130 port 59380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 17:53:47 host2 sshd[1605752]: Disconnected from invalid user admin 151.10.70.52 port 45568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-16 17:54:11 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:52150: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-11-16 17:54:48 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:59682: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:56:22 host2 sshd[1608570]: Disconnected from invalid user git 162.223.91.130 port 55550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 16 17:57:07 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, session=<q0RYWbVDdOADU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:57:24 host2 sshd[1609514]: Disconnected from invalid user mahsa 162.223.91.130 port 54266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 18:00:06 host2 sshd[1611914]: Disconnected from invalid user avinash 151.10.70.52 port 55836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 18:01:33 host2 sshd[1613362]: Disconnected from invalid user mahsa 151.10.70.52 port 58114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2025-11-16 18:04:35 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:47580: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-16 18:05:30 dovecot_login authenticator failed for ([189.56.191.126]) [189.44.133.238]:53714: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.108
country_id: 3175395
description:
Nov 16 18:07:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.68.179.108, lip=66.85.158.91, TLS, session=<MgoPfrVDZKq5RLNs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.120
country_id: 3469034
description:
Nov 16 18:07:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=179.106.87.120, lip=66.85.158.91, TLS, session=<OzUWfLVDQYazald4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.94
country_id: 3469034
description:
Nov 16 18:13:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.248.94, lip=66.85.158.91, TLS, session=<yaHSkbVD/6O60fhe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.31
country_id: 953987
description:
Nov 16 18:13:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.62.31, lip=66.85.158.91, TLS, session=<zFEbk7VD2tZmgT4f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:14:45 host2 sshd[1624404]: Disconnected from invalid user ubuntu 147.50.227.142 port 37516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:16:26 host2 sshd[1625595]: Disconnected from invalid user hi 147.50.227.142 port 56544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.36.252
country_id: 6290252
description:
Nov 16 18:17:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=109.207.36.252, lip=66.85.158.91, TLS, session=<i1IWobVD5sdtzyT8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.76
country_id: 3996063
description:
Nov 16 18:17:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=207.248.113.76, lip=66.85.158.91, TLS, session=<rbECoLVDFZ3P+HFM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:18:26 host2 sshd[1626757]: Disconnected from invalid user csgo 170.79.37.88 port 45162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:18:57 host2 sshd[1627089]: Disconnected from invalid user ubuntu 170.79.37.88 port 36486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:19:34 host2 sshd[1627405]: Disconnected from invalid user cortega 147.50.227.142 port 35454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:19:46 host2 sshd[1627528]: Disconnected from invalid user hi 170.79.37.88 port 48460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:20:44 host2 sshd[1628207]: Disconnected from invalid user git 170.79.37.88 port 44602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:22:29 host2 sshd[1629175]: Disconnected from invalid user noel 147.50.227.142 port 55738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:24:00 host2 sshd[1630040]: Disconnected from invalid user user1 147.50.227.142 port 36894 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.168
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.168: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 18:25:56 host2 sshd[1631304]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.124.75
country_id: 2921044
description:
Nov 16 18:38:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.65.124.75, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6VeF7LVD1mmfQXxL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 18:40:13 host2 sshd[1638730]: Disconnected from invalid user admin 45.78.200.2 port 52960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-16 18:44:45 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:45016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-16 18:45:14 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:49684: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 18:47:53 host2 sshd[1643275]: Disconnected from invalid user frappe 2.57.121.112 port 61796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 18:50:25 host2 sshd[1644692]: Disconnected from invalid user admin 2.57.121.112 port 25015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.220
country_id: 798544
description:
Nov 16 18:53:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.216.25.220, lip=66.85.158.91, TLS, session=<cXXxIrZD4tCy2Bnc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.138
country_id: 798544
description:
Nov 16 18:54:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=178.216.25.138, lip=66.85.158.91, TLS, session=<UDEPJLZDZoiy2BmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-16 18:59:24 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:50953: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-16 18:59:37 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:49992: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-11-16 18:59:52 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:38614: 535 Incorrect authentication data (set_id=careers)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 31.59.174.50
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 31.59.174.50: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.39
country_id: 1880251
description:
Nov 16 19:03:31 host2 sshd[1654060]: Disconnected from invalid user ubuntu 45.78.227.39 port 45238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:04:54 host2 sshd[1655019]: Disconnected from invalid user marek 85.121.48.71 port 60494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 19:05:12 host2 sshd[1655340]: Disconnected from invalid user admin 45.78.200.2 port 41956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:06:05 host2 sshd[1656007]: Disconnected from invalid user danya 85.121.48.71 port 60596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 19:07:49 host2 sshd[1657152]: Disconnected from invalid user admin 45.78.200.2 port 57810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:10:39 host2 sshd[1659297]: Disconnected from invalid user admin 85.121.48.71 port 60936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.30
country_id: 798544
description:
Nov 16 19:11:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.246.105.30, lip=66.85.158.91, TLS, session=<4V77Y7ZDAOlb9mke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-16 19:12:00 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:47336: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.135
country_id: 3469034
description:
Nov 16 19:17:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.251.135, lip=66.85.158.91, TLS, session=<ssgKdrZDkby60fuH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.160
country_id: 2300660
description:
Nov 16 19:17:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.5.160, lip=66.85.158.91, TLS, session=<7Zw8d7ZDt9spiwWg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:18:26 host2 sshd[1663975]: Disconnected from invalid user nominatim 128.1.131.163 port 54570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:19:44 host2 sshd[1664630]: Disconnected from invalid user sasaki 128.1.131.163 port 59212 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 19:20:15 host2 sshd[1665088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.7
country_id: 2921044
description:
Nov 16 19:20:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.227.159.7, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oLKsgrZDjoWl458H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.22.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 64.253.22.237 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:23:35 host2 sshd[1666930]: Disconnected from invalid user wangziyun 128.1.131.163 port 56102 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.82.65.48
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.82.65.48 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 16 19:24:00 host2 sshd[1667112]: Invalid user lankaherbalsolutions from 152.32.201.11 port 63340


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:27:06 host2 sshd[1668998]: Disconnected from invalid user ubuntu 107.175.39.180 port 43598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.123
country_id: 933860
description:
Nov 16 19:28:04 host2 sshd[1669578]: Disconnected from invalid user nmrsu 168.167.228.123 port 33076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:28:30 host2 sshd[1669767]: Disconnected from invalid user llm 107.175.39.180 port 52440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:29:48 host2 sshd[1670395]: Disconnected from invalid user diquest 107.175.39.180 port 48812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:31:02 host2 sshd[1671198]: Disconnected from invalid user testing 107.175.39.180 port 40464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:33:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QtCDsbZDVtwjy9Op>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-16 19:34:20 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:46408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:34:22 host2 sshd[1673049]: Disconnected from invalid user newuser1 23.91.96.70 port 44414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:34:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<InJVtbZD+vcjy9Op>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-16 19:34:36 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:48246: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Nov 16 19:35:45 host2 sshd[1673912]: Disconnected from invalid user es_user 168.167.228.123 port 33081 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.198
country_id: 690791
description:
Nov 16 19:38:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=37.221.158.198, lip=66.85.158.91, TLS, session=<8ZNyw7ZD35kl3Z7G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.255
country_id: 3057568
description:
Nov 16 19:38:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=91.226.113.255, lip=66.85.158.91, TLS, session=<E0uLxLZDO6Bb4nH/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 16 19:39:37 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<wSbnx7ZDPuDPWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:40:18 host2 sshd[1676563]: Disconnected from invalid user steam 23.91.96.70 port 56524 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:40:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS, session=</rZNzLZDpv0jy9Op>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.229
country_id: 690791
description:
Nov 16 19:40:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=176.103.0.229, lip=66.85.158.91, TLS, session=<7eaBy7ZDSsOwZwDl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.31
country_id: 690791
description:
Nov 16 19:41:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=194.44.140.31, lip=66.85.158.91, TLS, session=<53OdzLZDec/CLIwf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:42:20 host2 sshd[1677618]: Disconnected from invalid user administrador 23.91.96.70 port 51158 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.87
country_id: 6252001
description:
Nov 16 19:47:55 host2 pure-ftpd[1681101]: (?@195.184.76.87) [INFO] New connection from 195.184.76.87


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.146
country_id: 6252001
description:
Nov 16 19:47:55 host2 pure-ftpd[1681103]: (?@195.184.76.146) [INFO] New connection from 195.184.76.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.83.225
country_id: 1880251
description:
Nov 16 19:48:04 host2 pure-ftpd[1681247]: (?@159.223.83.225) [INFO] New connection from 159.223.83.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.6
country_id: 1733045
description:
2025-11-16 19:50:51 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:58584: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.225.224
country_id: 3017382
description:
2025-11-16 19:51:17 dovecot_login authenticator failed for 82-64-225-224.subs.proxad.net [82.64.225.224]:50830: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-16 19:53:10 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:58184: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-16 19:53:31 dovecot_login authenticator failed for ([187.218.57.50]) [187.218.57.50]:3643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.123
country_id: 2264397
description:
Nov 16 19:53:58 host2 pure-ftpd[1684752]: (?@45.156.128.123) [INFO] New connection from 45.156.128.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 16 20:08:55 host2 sshd[1695075]: Invalid user lankaherbalsolutions from 152.32.201.11 port 15358


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-16 20:15:40 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:47929: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-16 20:15:53 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:56788: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 16 20:17:21 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<J/reTrdDfJ3PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 20:17:51 host2 sshd[1700214]: Disconnected from invalid user user 2.57.121.25 port 54693 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:18:49 host2 sshd[1700706]: Disconnected from invalid user admin 2.57.121.112 port 27886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.221.149
country_id: 2077456
description:
2025-11-16 20:21:08 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:33772: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:21:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<84RsXLdD2NWTuYUW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 20:21:29 host2 sshd[1702377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:21:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RgpYXbdDEvmTuYUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.19
country_id: 1733045
description:
2025-11-16 20:22:14 dovecot_login authenticator failed for ([49.124.153.19]) [49.124.153.19]:36440: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:23:43 host2 sshd[1703415]: Disconnected from invalid user  2.57.121.112 port 62546 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.209.243
country_id: 1819730
description:
Nov 16 20:25:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=123.58.209.243, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ihU9ardD0u57OtHz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 20:25:22 host2 sshd[1704477]: Disconnected from invalid user alysha 62.60.131.157 port 33887 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:26:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS, session=<GrLBb7dD5PKTuYUW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.44.96.189
country_id: 3469034
description:
Nov 16 20:27:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=177.44.96.189, lip=66.85.158.91, session=<a5+ic7dDpcmxLGC9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.128
country_id: 3175395
description:
Nov 16 20:27:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.128, lip=66.85.158.91, TLS, session=<BV20c7dDMrzZGrOA>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 119.28.107.251 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.247
country_id: 2300660
description:
Nov 16 20:28:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.28.247, lip=66.85.158.91, TLS, session=<U8WZdbdDYrEpixz3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:29:38 host2 sshd[1706828]: Disconnected from invalid user  2.57.121.112 port 62523 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.0.191.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.0.191.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.239.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.111.239.143 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.239.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.35.239.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 16 20:34:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<YQxIjLdD2HtChJl7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.237.136.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.237.136.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.178.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.213.178.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.55.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.5.55.206 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.250.137.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.250.137.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.81.97
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.178.81.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.154.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.154.151 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.42.173.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.42.173.206 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.80.137.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.80.137.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.8.248.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.8.248.181 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.119.180
country_id: 2215636
description:
Nov 16 20:40:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=169.239.119.180, lip=66.85.158.91, TLS, session=<OTcyn7dDDqGp73e0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.108
country_id: 690791
description:
Nov 16 20:40:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=37.221.158.108, lip=66.85.158.91, TLS, session=<AIZvoLdDB6kl3Z5s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:40:41 host2 sshd[1715737]: Disconnected from invalid user titus 38.47.92.86 port 47478 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:43:31 host2 sshd[1717804]: Disconnected from invalid user vtatis 38.47.92.86 port 45630 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.124.230.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 147.124.230.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:48:20 host2 sshd[1721146]: Disconnected from invalid user jiel 38.47.92.86 port 43740 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.173.58.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.173.58.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.34.236.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.34.236.246 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.51.207.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.51.207.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.253.243.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 147.253.243.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.239.186.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.239.186.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.32.81.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 136.32.81.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 20:52:11 host2 sshd[1723648]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.139
country_id: 3175395
description:
Nov 16 20:52:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.139.180.139, lip=66.85.158.91, TLS, session=<aJ97y7dDkQm5i7SL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.69.35
country_id: 3469034
description:
Nov 16 20:52:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.72.69.35, lip=66.85.158.91, TLS, session=<Bn1OyrdD4KexSEUj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-16 20:54:39 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:51026: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.180.252.183
country_id: 6252001
description:
2025-11-16 20:54:48 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:35290: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.248.101.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.248.101.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.185.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.127.185.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.8.108.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.8.108.11 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.220.205.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.220.205.1 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.31.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.31.24 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.96.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.70.96.111 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.2.62.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.2.62.202 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.186
country_id: 2635167
description:
Nov 16 21:01:02 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.186, lip=66.85.158.91, TLS, session=<kc4Z67dDzde594m6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.154.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.17.154.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.135.15.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.135.15.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.37.107
country_id: 6252001
description:
[2025-11-16 21:02:43 +0530] info [whostmgrd] 47.150.37.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.163.136.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.163.136.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-16 21:02:50 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56346: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.178.87.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.178.87.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.59.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.73.59.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-16 21:02:17 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60326: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-11-16 21:02:37 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:49318: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.84.69.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.84.69.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:07:50 host2 sshd[1733861]: Disconnected from invalid user test 103.153.190.105 port 42591 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.28.129.102
country_id: 6252001
description:
[2025-11-16 21:08:18 +0530] info [cpaneld] 23.28.129.102 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.133.203.35
country_id: 6252001
description:
[2025-11-16 21:08:29 +0530] info [cpaneld] 72.133.203.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.22.70
country_id: 6252001
description:
[2025-11-16 21:08:33 +0530] info [whostmgrd] 67.188.22.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.74.84.235
country_id: 6252001
description:
[2025-11-16 21:08:44 +0530] info [cpaneld] 148.74.84.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.12.249
country_id: 6252001
description:
[2025-11-16 21:08:31 +0530] info [cpaneld] 47.158.12.249 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.212.106
country_id: 6252001
description:
[2025-11-16 21:08:41 +0530] info [cpaneld] 73.23.212.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.119.11
country_id: 6252001
description:
[2025-11-16 21:08:48 +0530] info [cpaneld] 143.105.119.11 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 16 21:12:00 host2 sshd[1736279]: Invalid user visionsolutionshospital from 154.219.110.64 port 52352


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 21:15:51 host2 sshd[1738362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.251
country_id: 6252001
description:
Nov 16 21:21:18 host2 pure-ftpd[1741594]: (?@198.235.24.251) [INFO] New connection from 198.235.24.251


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 16 21:24:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<jg/VPbhDZCvY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Nov 16 21:24:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B+j7PrhDcnxAPpze>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:26:25 host2 sshd[1744638]: Disconnected from invalid user npm 103.153.190.105 port 38264 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.141.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.49.141.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.225.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.5.225.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.60.64.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.60.64.250 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.171.30
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.2.171.30 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 16 21:30:27 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, TLS, session=<r6pRVLhDcposyhQX>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.114.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.144.114.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.200.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.104.200.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.84.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.47.84.138 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:37:48 host2 sshd[1751593]: Disconnected from invalid user jhcho 177.8.166.171 port 57488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:39:37 host2 sshd[1752403]: Disconnected from invalid user test 177.8.166.171 port 39518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:40:44 host2 sshd[1753161]: Disconnected from invalid user dylan 201.243.82.123 port 58004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2025-11-16 21:40:45 dovecot_login authenticator failed for ([49.125.201.84]) [49.125.201.84]:43848: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-16 21:41:04 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:57336: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:40:08 host2 sshd[1752784]: Disconnected from invalid user tesoreria 103.153.190.105 port 59450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:41:16 host2 sshd[1753472]: Disconnected from invalid user admin 177.8.166.171 port 33840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:44:42 host2 sshd[1756308]: Disconnected from invalid user me 103.153.190.105 port 42061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:46:43 host2 sshd[1769818]: Disconnected from invalid user ubuntu 201.243.82.123 port 34498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:49:22 host2 sshd[1771539]: Disconnected from invalid user ubuntu 103.153.190.105 port 53625 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:50:38 host2 sshd[1772317]: Disconnected from invalid user ubuntu 201.243.82.123 port 36780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:52:10 host2 sshd[1773079]: Disconnected from invalid user admin 201.243.82.123 port 37918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:53:50 host2 sshd[1773883]: Disconnected from invalid user bit 103.153.190.105 port 33794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-11-16 21:54:26 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:42926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-16 21:54:42 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:34468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.83
country_id: 6252001
description:
Nov 16 21:58:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.155.83, lip=66.85.158.91, TLS: Connection closed, session=<l2IXurhDmvnHLZtT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.180
country_id: 6252001
description:
Nov 16 21:59:12 host2 pure-ftpd[1777677]: (?@198.235.24.180) [INFO] New connection from 198.235.24.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.73
country_id: 6252001
description:
Nov 16 22:11:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.73, lip=66.85.158.92, session=<C4Dp5bhD40JAPsVJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 16 22:11:12 host2 sshd[1785091]: Invalid user lankaherbalsolutions from 102.213.181.98 port 49794


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.195
country_id: 6252001
description:
Nov 16 22:11:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9kmW5rhDNddAPsXD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Nov 16 22:11:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iJLU57hD7odAPsW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 16 22:11:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS: Connection closed, session=<5B605rhDjIVAPsU+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 22:11:54 host2 sshd[1785464]: Disconnected from invalid user  2.57.121.112 port 61426 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.244.152.105
country_id: 6252001
description:
Nov 16 22:20:30 host2 pure-ftpd[1790603]: (?@143.244.152.105) [INFO] New connection from 143.244.152.105


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.204
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.204: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 22:30:22 host2 sshd[1798107]: Disconnected from invalid user admin 2.57.121.112 port 30008 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 22:36:40 host2 sshd[1801373]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.200
country_id: 6252001
description:
Nov 16 22:38:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.200, lip=66.85.158.91, session=<pNgQRrlD7RBAPpzI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 16 22:38:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS: Connection closed, session=<XsniRrlDwKBAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.236
country_id: 6251999
description:
Nov 16 22:56:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.202.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6N3ah7lDcu2Ay8rs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-16 23:00:16 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:58544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-16 23:01:19 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:55948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.0
country_id: 6252001
description:
Nov 16 23:01:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.0, lip=66.85.158.91, TLS handshaking: Connection closed, session=<M0wGmblD8pkUQcEA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:06:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 33 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cedgrLlDLrNChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:18:46 host2 sshd[1832162]: Disconnected from invalid user aa 146.190.154.85 port 33408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:20:09 host2 sshd[1833146]: Disconnected from invalid user builduser 146.190.154.85 port 55530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:23:41 host2 sshd[1835360]: Disconnected from invalid user panel 146.190.154.85 port 40648 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 23:30:29 host2 sshd[1839976]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.163
country_id: 6252001
description:
Nov 16 23:31:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.163, lip=66.85.158.92, TLS, session=<vRzKA7pDGK0UQcGj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:32:36 host2 sshd[1841375]: Disconnected from invalid user deploy 103.159.132.91 port 56364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 23:33:31 host2 sshd[1841981]: Disconnected from invalid user user 2.57.121.25 port 36501 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.126
country_id: 6252001
description:
Nov 16 23:34:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.126, lip=66.85.158.92, TLS handshaking: Connection closed, session=</cpPDrpDy31BMQF+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Nov 16 23:34:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IBGfD7pDqP5BMQF6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 16 23:35:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<CUxkE7pDTAxChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:35:46 host2 sshd[1843953]: Disconnected from invalid user rami 103.159.132.91 port 57758 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:37:19 host2 sshd[1845202]: Disconnected from invalid user landi 103.159.132.91 port 58460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 16 23:37:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.163, lip=66.85.158.92, session=<pLo3GrpDT//CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:38:47 host2 sshd[1846389]: Disconnected from invalid user sanjay 103.159.132.91 port 59154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:40:13 host2 sshd[1847534]: Disconnected from invalid user sshuser 103.159.132.91 port 59852 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.26
country_id: 6252001
description:
Nov 16 23:42:35 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.26, lip=66.85.158.91, session=<5yPVLLpD4JSH7X0a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:45:47 host2 sshd[1852152]: Disconnected from invalid user sanjay 152.32.172.146 port 35564 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov 16 23:45:58 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, session=<THTzOLpDTq4tT4DN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 16 23:46:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mR5SPLpDNGtKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 16 23:47:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6eOYPbpD8jlKUi8C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:49:25 host2 sshd[1854731]: Disconnected from invalid user stack 152.32.172.146 port 43020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 16 23:50:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<7l9KSbpDDmhChJl3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:50:50 host2 sshd[1855689]: Disconnected from invalid user lzj 152.32.172.146 port 60902 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 23:51:37 host2 sshd[1856116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-16 23:52:39 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:48543: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 23:52:43 host2 sshd[1857185]: Disconnected from invalid user admin 2.57.121.112 port 41289 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-16 23:52:58 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:43194: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 16 23:53:00 host2 sshd[1857381]: Disconnected from invalid user pwserver 138.84.41.210 port 5691 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:53:19 host2 sshd[1857620]: Disconnected from invalid user dmp 152.32.172.146 port 54308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 16 23:53:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, session=<xS10U7pDRMeUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:54:06 host2 sshd[1858282]: Disconnected from invalid user wanghao 158.178.141.16 port 10436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-11-16 23:55:07 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:53812: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:55:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<D4MsWrpDIHtChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:55:44 host2 sshd[1860303]: Disconnected from invalid user art1 51.77.149.244 port 45196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-16 23:55:47 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:41332: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:55:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 2 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<XpuoWrpDCDdChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:57:58 host2 sshd[1861692]: Disconnected from invalid user testadmin 158.178.141.16 port 61972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:58:06 host2 sshd[1861811]: Disconnected from invalid user ftpuser 51.77.149.244 port 55454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:59:12 host2 sshd[1862529]: Disconnected from invalid user wanghao 51.77.149.244 port 44184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 16 23:58:22 host2 sshd[1862060]: Disconnected from invalid user utente 138.84.41.210 port 7762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:59:26 host2 sshd[1862636]: Disconnected from invalid user synology 158.178.141.16 port 52868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 17 00:00:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<70jra7pDPKa4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:00:18 host2 sshd[1863548]: Disconnected from invalid user felix 51.77.149.244 port 44078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 17 00:00:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS: Connection closed, session=<Mky4bLpDFHO4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:00:53 host2 sshd[1863974]: Disconnected from invalid user lighthouse 158.178.141.16 port 14182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.137
country_id: 6252001
description:
Nov 17 00:01:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.137, lip=66.85.158.92, session=<tsw4crpDWrCH7X2J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:01:22 host2 sshd[1864377]: Disconnected from invalid user synology 51.77.149.244 port 51570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 17 00:02:47 host2 sshd[1865250]: Disconnected from invalid user ftpuser 38.100.203.79 port 42936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 17 00:03:21 host2 sshd[1866003]: Disconnected from invalid user stack 138.84.41.210 port 27358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:03:42 host2 sshd[1866271]: Disconnected from invalid user victor 158.178.141.16 port 60606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:03:34 host2 sshd[1866146]: Disconnected from invalid user jarservice 51.77.149.244 port 33274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 17 00:05:53 host2 sshd[1868182]: Disconnected from invalid user esuser 38.100.203.79 port 53894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:05:38 host2 sshd[1867968]: Disconnected from invalid user testadmin 51.77.149.244 port 59312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:07:45 host2 sshd[1869285]: Disconnected from invalid user pc 158.178.141.16 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 17 00:08:27 host2 sshd[1869745]: Disconnected from invalid user test3 138.84.41.210 port 38638 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:09:10 host2 sshd[1870192]: Disconnected from invalid user harry 158.178.141.16 port 11572 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.90.3
country_id: 6252001
description:
Nov 17 00:10:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.90.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<QM6YkLpDXMo0pVoD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.83
country_id: 798544
description:
2025-11-17 00:11:30 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:62466: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:26:48 host2 sshd[1880943]: Disconnected from invalid user vishal 177.157.205.143 port 60740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:29:17 host2 sshd[1882628]: Disconnected from invalid user admin 23.150.152.105 port 55088 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 00:31:03 host2 sshd[1883954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:31:59 host2 sshd[1884457]: Disconnected from invalid user admin 23.150.152.105 port 39956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.14.28
country_id: 1668284
description:
Nov 17 00:32:53 host2 sshd[1885017]: Disconnected from invalid user admin 165.154.14.28 port 39684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:34:23 host2 sshd[1885881]: Disconnected from invalid user app 23.150.152.105 port 35722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:34:55 host2 sshd[1886148]: Disconnected from invalid user admin 177.157.205.143 port 38614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:36:36 host2 sshd[1887354]: Disconnected from invalid user admin 23.150.152.105 port 59700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 17 00:36:56 host2 sshd[1887537]: Invalid user lankaherbalsolutions from 152.32.201.11 port 45162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.14.28
country_id: 1668284
description:
Nov 17 00:37:59 host2 sshd[1888065]: Disconnected from invalid user osadmin 165.154.14.28 port 33884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 17 00:37:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pGnI8bpD8EKnXpI8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:39:28 host2 sshd[1888903]: Disconnected from invalid user sftpuser 177.157.205.143 port 49930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.86.194
country_id: 2635167
description:
Nov 17 00:39:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.99.86.194, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pMkZ+bpDjI2nY1bC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-17 00:55:25 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:52090: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov 17 00:55:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zfrdMrtDm9nN0h/f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:00:08 host2 sshd[1903860]: Disconnected from invalid user ljsoft 196.0.120.211 port 38470 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.130.219.52
country_id: 2017370
description:
[2025-11-17 01:01:50 +0530] info [cpaneld] 188.130.219.52 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:04:22 host2 sshd[1907497]: Disconnected from invalid user amit 196.0.120.211 port 47758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:06:02 host2 sshd[1908547]: Disconnected from invalid user dennis 196.0.120.211 port 47750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:07:36 host2 sshd[1909279]: Disconnected from invalid user testuser 196.0.120.211 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 01:08:18 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57492: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-17 01:08:34 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:40520: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:10:56 host2 sshd[1912132]: Disconnected from invalid user ubuntu 43.167.238.118 port 42046 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.210
country_id: 6252001
description:
Nov 17 01:11:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.210, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mgeSartDedPN0h/S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:12:22 host2 sshd[1912941]: Disconnected from invalid user lol 43.167.238.118 port 49360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:13:48 host2 sshd[1913668]: Disconnected from invalid user user2 43.167.238.118 port 58404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:13:55 host2 sshd[1913709]: Disconnected from invalid user admin 2.57.121.112 port 39713 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.217
country_id: 1643084
description:
Nov 17 01:16:13 host2 sshd[1915434]: Invalid user lankaherbalsolutions from 103.189.235.217 port 55688


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.116.91.180 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 136.116.91.180 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.151
country_id: 1880251
description:
Nov 17 01:19:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.189.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xTAdhrtDx5oP672X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.159
country_id: 1880251
description:
Nov 17 01:19:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.189.159, lip=66.85.158.91, TLS: Connection closed, session=<6stNhrtDedEP672f>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.158
country_id: 1880251
description:
Nov 17 01:18:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=15.235.189.158, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OKF5g7tDw5kP672e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.145
country_id: 1880251
description:
Nov 17 01:18:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=15.235.189.145, lip=66.85.158.91, TLS: Connection closed, session=<IS10hLtDBe4P672R>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Nov 17 01:20:30 host2 sshd[1918644]: Disconnected from invalid user bala 34.131.131.43 port 60646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 01:23:18 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49311: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 01:24:37 host2 sshd[1920791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:25:53 host2 sshd[1921739]: Disconnected from invalid user ubuntu 182.93.50.90 port 55466 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov 17 01:26:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<J8wOobtDu/7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:27:11 host2 sshd[1922298]: Disconnected from invalid user  2.57.121.112 port 62083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-17 01:29:22 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:49270: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-11-17 01:29:49 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:47448: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:32:51 host2 sshd[1925353]: Disconnected from invalid user  2.57.121.112 port 62633 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:35:05 host2 sshd[1926685]: Disconnected from invalid user user2 182.93.50.90 port 48416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-17 01:37:49 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:60882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:38:12 host2 sshd[1928656]: Disconnected from invalid user admin 182.93.50.90 port 43880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-11-17 01:38:27 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:39762: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.39
country_id: 6252001
description:
Nov 17 01:39:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qku+zrtDuM+TuYQn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:44:18 host2 sshd[1932790]: Disconnected from invalid user sage 182.93.50.90 port 53420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.217
country_id: 1643084
description:
Nov 17 01:45:16 host2 sshd[1933817]: Invalid user lankaherbalsolutions from 103.189.235.217 port 58940


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-17 01:57:01 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:48886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov 17 02:08:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</SnSN7xDwv7CpRCi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov 17 02:11:44 host2 pure-ftpd[1950930]: (?@205.210.31.172) [INFO] New connection from 205.210.31.172


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.87
country_id: 6252001
description:
Nov 17 02:13:53 host2 pure-ftpd[1951943]: (?@205.210.31.87) [INFO] New connection from 205.210.31.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-17 02:16:05 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:60660: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-11-17 02:15:37 dovecot_login authenticator failed for ([103.83.130.80]) [103.83.130.80]:59988: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-17 02:16:24 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:48552: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 17 02:20:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I1C4YrxDmEVChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 02:21:29 dovecot_login authenticator failed for (kqTHO1) [195.24.237.117]:64061: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 02:25:00 host2 sshd[1958062]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Nov 17 02:28:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<v6Smf7xDxK9C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.206
country_id: 1861060
description:
2025-11-17 02:31:57 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:62434: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-17 02:32:19 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:56608: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.50
country_id: 3017382
description:
Nov 17 02:35:38 host2 pure-ftpd[1964811]: (?@91.196.152.50) [INFO] New connection from 91.196.152.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov 17 02:35:37 host2 pure-ftpd[1964809]: (?@91.196.152.49) [INFO] New connection from 91.196.152.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Nov 17 02:36:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<50owm7xDIduTuYTw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov 17 02:38:30 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.210.228, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<vO3wobxD8JuUcdLk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-17 02:45:13 dovecot_login authenticator failed for ([125.17.28.112]) [125.17.28.138]:45444: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 02:45:57 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:45964: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 03:03:56 dovecot_login authenticator failed for (f1qMruxJU) [195.24.237.117]:60831: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:05:54 host2 sshd[1984067]: Disconnected from invalid user maria 2.57.121.112 port 62335 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 03:08:03 dovecot_login authenticator failed for (OrbmUaUEMl) [195.24.237.117]:61085: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:09:11 host2 sshd[1986142]: Disconnected from invalid user admin 2.57.121.112 port 28709 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 03:18:24 host2 sshd[1992224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:21:27 host2 sshd[1994167]: Disconnected from invalid user deployer 209.141.53.124 port 37390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:23:51 host2 sshd[1995613]: Disconnected from invalid user teamspeak 107.172.15.139 port 53290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:23:15 host2 sshd[1995308]: Disconnected from invalid user prueba 209.141.53.124 port 36652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:26:38 host2 sshd[1997590]: Disconnected from invalid user phoenix 107.172.15.139 port 54770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:27:57 host2 sshd[1998415]: Disconnected from invalid user ftpuser 107.172.15.139 port 43974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:29:14 host2 sshd[1999116]: Disconnected from invalid user m 107.172.15.139 port 54532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:40:47 host2 sshd[2006329]: Disconnected from invalid user m 209.141.53.124 port 57596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:53:38 host2 sshd[2017442]: Disconnected from invalid user admin 2.57.121.112 port 22589 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 17 03:54:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZuassL1DWP4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.116.162.215
country_id: 6251999
description:
2025-11-17 03:57:31 dovecot_login authenticator failed for ([206.116.162.215]) [206.116.162.215]:39204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.115.177.212
country_id: 6251999
description:
2025-11-17 03:57:52 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:57598: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:11:36 host2 sshd[2036577]: Disconnected from invalid user zz 77.74.229.158 port 60124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:13:04 host2 sshd[2038391]: Disconnected from invalid user wialon 156.236.75.209 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:14:41 host2 sshd[2040012]: Disconnected from invalid user ludmila 156.236.75.209 port 46666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:15:08 host2 sshd[2040477]: Disconnected from invalid user kirin 155.4.244.169 port 54722 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 04:18:44 host2 sshd[2045913]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:18:35 host2 sshd[2045850]: Disconnected from invalid user pterodactyl 155.4.244.169 port 19717 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:19:10 host2 sshd[2046163]: Disconnected from invalid user qwerty 156.236.75.209 port 37864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:20:09 host2 sshd[2046799]: Disconnected from invalid user ludmila 155.4.244.169 port 40164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:20:13 host2 sshd[2046891]: Disconnected from invalid user mysqladmin 77.74.229.158 port 48432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:21:32 host2 sshd[2047714]: Disconnected from invalid user insight 77.74.229.158 port 33898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 17 04:22:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<AKQFF75DvAjCpRCh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:23:46 host2 sshd[2049168]: Disconnected from invalid user debian 155.4.244.169 port 14016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:24:17 host2 sshd[2049479]: Disconnected from invalid user t 77.74.229.158 port 47272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:24:45 host2 sshd[2049680]: Disconnected from invalid user qwerty 103.98.176.164 port 39560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:26:25 host2 sshd[2050878]: Disconnected from invalid user wialon 103.98.176.164 port 60166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.28.73.178
country_id: 3923057
description:
2025-11-17 04:27:48 dovecot_plain authenticator failed for ([31.57.166.48]) [189.28.73.178]:8418: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:28:46 host2 sshd[2052096]: Disconnected from invalid user jet 156.236.75.209 port 55086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:31:30 host2 sshd[2053912]: Disconnected from invalid user debian 103.98.176.164 port 39346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Nov 17 04:33:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SyB1O75Db46594lM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.52
country_id: 2635167
description:
Nov 17 04:32:59 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.52, lip=66.85.158.91, TLS, session=<W3hhO75DT95X7LA0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Nov 17 04:33:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<m5NwPb5D/5i594lX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.83
country_id: 2635167
description:
Nov 17 04:34:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.83, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<oSZsP75DT5W594lT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Nov 17 04:34:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<RZxnQb5D4Y+594ld>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 04:35:53 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:55315: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.174
country_id: 6252001
description:
Nov 17 04:35:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.174, lip=66.85.158.92, session=<Y64iRr5DWP7G6xiu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Nov 17 04:35:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<mQxjQ75DK5tX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.90
country_id: 2635167
description:
Nov 17 04:35:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.90, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<x3NcRb5DQ7e594la>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Nov 17 04:36:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<xKxZR75Dv7FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Nov 17 04:36:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GhBVSb5DhZhX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.105
country_id: 2635167
description:
Nov 17 04:37:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<WINOS75DF5pX7LBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov 17 04:37:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<+dhJTb5Dj4W594lS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 17 04:38:37 host2 sshd[2058086]: Invalid user lankaherbalsolutions from 152.32.201.11 port 62930


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 04:44:21 host2 sshd[2061659]: Disconnected from invalid user joyce 2.57.121.112 port 62389 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 17 04:46:53 host2 sshd[2063647]: Invalid user lankaherbalsolutions from 102.213.181.98 port 41068


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 04:48:09 host2 sshd[2064494]: Disconnected from invalid user user 2.57.121.25 port 37541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.71.35
country_id: 6252001
description:
2025-11-17 04:48:15 dovecot_login authenticator failed for ([65.76.71.35]) [65.76.71.35]:36094: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-11-17 04:48:33 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:52002: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 04:49:57 host2 sshd[2066060]: Disconnected from invalid user  2.57.121.112 port 63052 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.110
country_id: 2635167
description:
Nov 17 04:52:03 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.110, lip=66.85.158.92, TLS, session=<KoqPf75DZ+NX7LBu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 04:56:21 host2 sshd[2070727]: Disconnected from invalid user karson 62.60.131.157 port 12490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.71.227.12
country_id: 285570
description:
2025-11-17 04:56:45 dovecot_plain authenticator failed for ([31.57.166.48]) [188.71.227.12]:60210: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Nov 17 05:04:27 host2 sshd[2075743]: Disconnected from invalid user david 195.199.212.141 port 39570 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.92.242.214
country_id: 2750405
description:
Nov 17 05:06:44 host2 pure-ftpd[2077284]: (?@91.92.242.214) [INFO] New connection from 91.92.242.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:07:39 host2 sshd[2077732]: Disconnected from invalid user angela 103.187.165.26 port 46280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-17 05:15:02 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:43857: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 05:14:48 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:34780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:15:18 host2 sshd[2082930]: Disconnected from invalid user nextcloud 103.187.165.26 port 41114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Nov 17 05:16:29 host2 sshd[2083826]: Disconnected from invalid user ubuntu 195.199.212.141 port 59092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:16:57 host2 sshd[2084105]: Disconnected from invalid user mysftp 103.187.165.26 port 37854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.92.242.214
country_id: 2750405
description:
Nov 17 05:18:07 host2 pure-ftpd[2084775]: (?@91.92.242.214) [INFO] New connection from 91.92.242.214


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.49.231
country_id: 6252001
description:
Nov 17 05:18:57 host2 pure-ftpd[2085273]: (?@20.169.49.231) [INFO] New connection from 20.169.49.231


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:18:35 host2 sshd[2085041]: Disconnected from invalid user foundry 103.187.165.26 port 45340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 05:19:41 host2 sshd[2085624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:20:57 host2 sshd[2086476]: Disconnected from invalid user pydio 130.107.240.11 port 57934 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov 17 05:22:50 host2 pure-ftpd[2087479]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.190.57
country_id: 6251999
description:
Nov 17 05:22:57 host2 pure-ftpd[2087540]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:26:10 host2 sshd[2090228]: Disconnected from invalid user user1 130.107.240.11 port 58972 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:27:37 host2 sshd[2090938]: Disconnected from invalid user user03 130.107.240.11 port 48688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:28:55 host2 sshd[2091896]: Disconnected from invalid user andreas 130.107.240.11 port 57322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-17 05:38:29 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:34572: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-17 05:39:19 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:57394: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 05:47:36 host2 sshd[2104659]: Disconnected from invalid user admin 2.57.121.112 port 15919 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 06:12:27 host2 sshd[2120751]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-17 06:15:36 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:48294: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-11-17 06:15:51 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:56625: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.111
country_id: 6252001
description:
Nov 17 06:27:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FO0H1L9DocTG6xhv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 06:28:25 host2 sshd[2129921]: Disconnected from invalid user admin 2.57.121.112 port 61983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:32:29 host2 sshd[2132611]: Disconnected from invalid user appuser 45.78.198.89 port 47220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:35:24 host2 sshd[2134331]: Disconnected from invalid user martin 185.158.22.150 port 50814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 06:36:25 host2 sshd[2135016]: Disconnected from invalid user user 2.57.121.25 port 19796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:41:52 host2 sshd[2137947]: Disconnected from invalid user maman 185.158.22.150 port 1960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:44:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RQFZEcBDDoYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:45:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<O0e8FsBDHpYDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:45:41 host2 sshd[2140500]: Disconnected from invalid user sanjay 185.158.22.150 port 61554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:46:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<s9ltGMBD0J4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 06:46:58 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:40492: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:47:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<80l8G8BDZo0DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-17 06:47:22 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:35292: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:49:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<V5lvIsBD/tMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 17 06:49:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BL0AI8BDEOBChJlx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:49:24 host2 sshd[2142481]: Disconnected from invalid user ubuntu 45.78.198.89 port 51132 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:51:09 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<vqSHKcBDGMEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:52:28 host2 sshd[2144300]: Disconnected from invalid user winter 185.158.22.150 port 2718 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:53:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<9ZT9MsBDkrUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Nov 17 06:54:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.195, lip=66.85.158.92, TLS, session=<FMpdNsBDXvyTuYTD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:54:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EB2eNsBDdKcDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:54:51 host2 sshd[2145963]: Disconnected from invalid user martin 45.78.198.89 port 46938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:55:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<608XOsBDWuUDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:58 host2 sshd[2147228]: Disconnecting invalid user admin 90.224.44.204 port 55466: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:46 host2 sshd[2147143]: Disconnecting authenticating user root 90.224.44.204 port 52996: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:46 host2 sshd[2147143]: error: maximum authentication attempts exceeded for root from 90.224.44.204 port 52996 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:57:44 host2 sshd[2147600]: Disconnected from invalid user maman 45.78.198.89 port 32798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-11-17 07:03:51 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:58083: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2025-11-17 07:04:17 dovecot_login authenticator failed for ([183.171.7.171]) [183.171.7.171]:33680: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-17 07:04:50 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:58510: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 07:06:04 host2 sshd[2153188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:25 host2 pure-ftpd[2161500]: (?@41.107.82.252) [WARNING] Authentication failed for user [awanish@maximsholdings.com]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:18 host2 pure-ftpd[2161500]: (?@41.107.82.252) [INFO] New connection from 41.107.82.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:19 host2 sshd[2161501]: Invalid user awanish@maximsholdings.com from 41.107.82.252 port 56975


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-17 07:23:04 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:47903: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2025-11-17 07:22:13 dovecot_login authenticator failed for ([49.124.149.217]) [49.124.149.217]:51328: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.65.108
country_id: 2077456
description:
2025-11-17 07:22:47 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:57170: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.177
country_id: 6252001
description:
Nov 17 07:30:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iTlbt8BDE9LG6xix>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 07:33:52 host2 sshd[2169088]: Disconnected from invalid user alex 62.60.131.157 port 44482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 07:35:22 host2 sshd[2170113]: Disconnected from invalid user user 2.57.121.25 port 37085 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:45:20 host2 sshd[2176456]: Disconnected from invalid user ftpuser 95.229.10.11 port 52970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:47:04 host2 sshd[2177252]: Disconnected from invalid user nexus 37.252.188.15 port 35398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:47:16 host2 sshd[2177338]: Disconnected from invalid user afzal 157.66.34.121 port 34258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:47:30 host2 sshd[2177450]: Disconnected from invalid user lijy 179.43.189.36 port 36238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:48:00 host2 sshd[2177664]: Disconnected from invalid user lijy 45.202.211.6 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:48:52 host2 sshd[2178210]: Disconnected from invalid user lijy 95.229.10.11 port 38176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:48:18 host2 sshd[2177870]: Disconnected from invalid user dmdba 37.252.188.15 port 36836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:49:50 host2 sshd[2178691]: Disconnected from invalid user thiago 179.43.189.36 port 33560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:50:54 host2 sshd[2179411]: Disconnected from invalid user ubuntu 179.43.189.36 port 38030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:50:32 host2 sshd[2179217]: Disconnected from invalid user st 37.252.188.15 port 39704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:50:39 host2 sshd[2179282]: Disconnected from invalid user debian 45.202.211.6 port 54052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:51:23 host2 sshd[2179906]: Disconnected from invalid user st 157.66.34.121 port 44026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:51:59 host2 sshd[2180450]: Disconnected from invalid user matias 45.202.211.6 port 60434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:53:12 host2 sshd[2181120]: Disconnected from invalid user ftpuser 179.43.189.36 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:53:27 host2 sshd[2181215]: Disconnected from invalid user st 95.229.10.11 port 40738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:54:20 host2 sshd[2182190]: Disconnected from invalid user dmdba 179.43.189.36 port 37032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:54:31 host2 sshd[2182326]: Disconnected from invalid user ubuntu 45.202.211.6 port 54490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:55:14 host2 sshd[2182900]: Disconnected from invalid user francesco 157.66.34.121 port 46218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:56:14 host2 sshd[2183465]: Disconnected from invalid user ftpuser 37.252.188.15 port 46880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 08:01:09 host2 sshd[2186186]: Disconnected from invalid user  2.57.121.112 port 62152 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 08:06:32 host2 sshd[2189533]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Nov 17 08:06:44 host2 pure-ftpd[2189739]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Nov 17 08:07:22 host2 pure-ftpd[2190058]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 08:12:06 host2 sshd[2192898]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 08:20:33 host2 sshd[2197924]: Disconnected from invalid user user 2.57.121.25 port 46187 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-17 08:25:01 dovecot_login authenticator failed for ([92.62.74.41]) [92.62.74.41]:38711: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 08:24:12 host2 sshd[2199922]: Disconnected from invalid user admin 2.57.121.112 port 17072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.249.105.213
country_id: 1605651
description:
2025-11-17 08:25:35 dovecot_login authenticator failed for ([43.249.105.213]) [43.249.105.213]:47674: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:25:38 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<xwxoe8FDqokDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-17 08:25:55 dovecot_login authenticator failed for ([180.129.66.134]) [180.129.66.134]:52915: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:28:53 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<lGQKh8FDsKIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:29:15 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<t3ZdiMFDvoYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:30:10 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<FZSgi8FD4LgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:32:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<8m54k8FDBo8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:32:46 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<TLHtlMFDVKIDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:33:10 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<c+ZWlsFDqucDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:34:48 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<cUkvnMFDDpoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:35:10 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<BvF5ncFDbIIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 08:35:39 host2 sshd[2206634]: Disconnected from invalid user brionna 62.60.131.157 port 26542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov 17 08:41:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.223, lip=66.85.158.91, TLS, session=<gZm9ssFDRPDN0h/f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.144
country_id: 3865483
description:
Nov 17 08:41:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=190.181.100.144, lip=66.85.158.91, TLS, session=<XN8ltMFDyMy+tWSQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.62.121
country_id: 2510769
description:
Nov 17 08:41:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=178.156.62.121, lip=66.85.158.91, TLS, session=<UL0Bs8FDib6ynD55>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 08:50:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61268: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 17 08:51:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<0qfg1sFDqueLonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.5
country_id: 1605651
description:
Nov 17 08:59:03 host2 pure-ftpd[2222823]: (?@103.176.152.5) [INFO] New connection from 103.176.152.5


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 09:00:05 host2 sshd[2223580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-17 09:04:04 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:64360: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-17 09:04:36 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:45477: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 09:32:32 host2 sshd[2245243]: Disconnecting invalid user  2.57.121.112 port 61664: Change of username or service not allowed: (,ssh-connection) -> (cisco,ssh-connection) [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:38:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IGJngMJDk9Ejy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:39:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<TbH6g8JDuOcjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:40:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<VPzShcJDjOojy9PW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:41:19 host2 sshd[2251077]: Disconnected from invalid user tobias 38.213.63.12 port 35190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:41:39 host2 sshd[2251210]: Disconnected from invalid user haproxy 179.125.24.202 port 56480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:42:37 host2 sshd[2251778]: Disconnected from invalid user sanjay 38.213.63.12 port 41690 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 17 09:43:05 host2 pure-ftpd[2252089]: (?@66.132.153.142) [INFO] New connection from 66.132.153.142


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:42:21 host2 sshd[2251641]: Disconnected from invalid user haproxy 4.213.138.243 port 43282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:42:24 host2 sshd[2251666]: Disconnected from invalid user duc 172.245.92.99 port 52982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:43:30 host2 sshd[2252274]: Disconnected from invalid user admin 200.7.101.139 port 44688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:43:41 host2 sshd[2252377]: Disconnected from invalid user sysadmin 172.245.92.99 port 46016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:44:30 host2 sshd[2252961]: Disconnected from invalid user admin 179.125.24.202 port 55730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:44:53 host2 sshd[2253307]: Disconnected from invalid user dev 172.245.92.99 port 34138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:45:04 host2 sshd[2253820]: Disconnected from invalid user dev 38.213.63.12 port 57176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:46:03 host2 sshd[2254550]: Disconnected from invalid user vlad 179.125.24.202 port 44860 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:46:15 host2 sshd[2254638]: Disconnected from invalid user fd 38.213.63.12 port 44666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:46:36 host2 sshd[2254764]: Disconnected from invalid user matthew 200.7.101.139 port 48786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:46:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS, session=<xdCbm8JDEvIjy9PW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:47:57 host2 sshd[2255363]: Disconnected from invalid user admin 200.7.101.139 port 53662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:47:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS, session=<+8gaoMJD2uYjy9PW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:49:12 host2 sshd[2256097]: Disconnected from invalid user adminuser 200.7.101.139 port 39914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Nov 17 09:49:26 host2 sshd[2256195]: Disconnected from invalid user uni 79.175.151.48 port 57432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:49:07 host2 sshd[2256043]: Disconnected from invalid user jeff 179.125.24.202 port 52900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:50:35 host2 sshd[2257078]: Disconnected from invalid user adminuser 179.125.24.202 port 32832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:51:45 host2 sshd[2257679]: Disconnected from invalid user coder 200.7.101.139 port 39040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:53:27 host2 sshd[2258591]: Disconnected from invalid user adminuser 4.213.138.243 port 50164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:55:01 host2 sshd[2259866]: Disconnected from invalid user coder 4.213.138.243 port 39826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:56:29 host2 sshd[2260989]: Disconnected from invalid user matthew 4.213.138.243 port 37486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-17 09:57:35 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:64726: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-17 09:57:45 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:30038: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.154
country_id: 6252001
description:
Nov 17 10:00:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.154, lip=66.85.158.92, TLS: Connection closed, session=<QqXHzcJDAq7HLZqa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov 17 10:11:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.236, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VuRA9MJDENLN0h/s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:16:07 host2 sshd[2272889]: Disconnected from invalid user ryan 50.6.231.66 port 37886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:20:42 host2 sshd[2275353]: Disconnected from invalid user user3 50.6.231.66 port 41288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:27:43 host2 sshd[2279217]: Disconnected from invalid user admin 50.6.231.66 port 45976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:28:57 host2 sshd[2279784]: Disconnected from invalid user usr1cv8 50.6.231.66 port 39032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.91
country_id: 6252001
description:
Nov 17 10:33:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=199.45.155.91, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zp6fRMNDuE/HLZtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-11-17 10:45:54 dovecot_login authenticator failed for (182.239.80.71.hk.chinamobile.com) [182.239.80.71]:55200: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.202.149
country_id: 2413451
description:
2025-11-17 10:45:14 dovecot_login authenticator failed for (197-255-202-149.netpagedns.net) [197.255.202.149]:55711: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-17 10:45:35 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:42565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-11-17 10:45:36 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:56516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 10:54:59 host2 sshd[2295085]: Disconnected from invalid user nestor 62.60.131.157 port 22774 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.245.104
country_id: 2802361
description:
Nov 17 10:58:32 host2 pure-ftpd[2297102]: (?@34.78.245.104) [INFO] New connection from 34.78.245.104


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 10:59:23 host2 sshd[2297475]: Disconnected from invalid user user 2.57.121.25 port 39406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:07:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7rKIv8NDHsMjy9IT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:08:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<09YXwcNDhPMjy9IT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-17 11:10:34 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:56974: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.144
country_id: 1694008
description:
2025-11-17 11:10:57 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.144]:59022: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:15:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS, session=<cEdP2cNDMuYjy9IT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 17 11:16:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.91, session=<ni1a3sNDSo8UQcHM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.97
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.97, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<eLl+6MND940tnIFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.98
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.98, lip=66.85.158.92, session=<AP936MND79EtnIFi>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.97
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.97, lip=66.85.158.92, TLS, session=<0UJ86MNDW6EtnIFh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.96
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.96, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a0KF6MND06EtnIFg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.95
country_id: 2264397
description:
Nov 17 11:19:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.95, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<mfCJ6MND8a0tnIFf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.98
country_id: 2264397
description:
Nov 17 11:19:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.98, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<eySR6MNDdZ0tnIFi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-17 11:26:36 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:54294: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.247
country_id: 6252001
description:
Nov 17 11:30:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.174.247, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1nk5D8RDFqAofK73>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.128.249
country_id: 6252001
description:
Nov 17 11:37:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.98.128.249, lip=66.85.158.92, session=<Jhs1K8RDKtQUYoD5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 11:43:34 host2 sshd[2322965]: Disconnected from invalid user user 2.57.121.25 port 25642 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 11:59:49 host2 sshd[2333477]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 17 12:02:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.161.174.170, lip=66.85.158.91, session=<3yChgcRDXLEzoa6q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.128.111
country_id: 6252001
description:
Nov 17 12:02:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.98.128.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CY0Pg8RD1JMUYoBv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 17 12:04:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TNNfisRDrcOTuYQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-17 12:08:59 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-17 12:09:20 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:45192: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 12:10:24 host2 sshd[2340104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 17 12:14:03 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<3CBKrMRD4tDPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Nov 17 12:14:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.231, lip=66.85.158.91, session=<YMN5rMRD9OfN0h/n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.147
country_id: 6252001
description:
Nov 17 12:20:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JsKxw8RDp8bDuEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.149
country_id: 6252001
description:
Nov 17 12:20:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.149, lip=66.85.158.91, TLS: Connection closed, session=<87NOxMRDwd/DuEyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.144
country_id: 6252001
description:
Nov 17 12:21:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.144, lip=66.85.158.91, TLS: Connection closed, session=<LbhRxcRDp+vDuEyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 12:28:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57495: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 17 12:34:14 host2 pure-ftpd[2364712]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 17 12:34:19 host2 pure-ftpd[2364782]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:38:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jfIiBMVD8rMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:39:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lvPjBsVDKMMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:40:16 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<LWcFCsVDlqEDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 12:41:41 host2 sshd[2372164]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:41:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0AuHDcVDZIwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:42:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YsmiEsVDAucDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:43:27 host2 sshd[2373928]: Disconnected from invalid user sanjay 165.22.63.108 port 45292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:43:30 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</wKcFcVDCKkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:44:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<O0pnGMVDctMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 12:45:26 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<WKGIHMVDALsDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-17 12:46:54 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43164: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:47:49 host2 sshd[2378557]: Disconnected from invalid user upload 165.22.63.108 port 52960 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:49:14 host2 sshd[2379956]: Disconnected from invalid user haproxy 165.22.63.108 port 44234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:50:39 host2 sshd[2381388]: Disconnected from invalid user robinson 165.22.63.108 port 34524 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.69
country_id: 6252001
description:
Nov 17 12:51:32 host2 pure-ftpd[2382005]: (?@172.202.118.69) [INFO] New connection from 172.202.118.69


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 17 12:53:30 host2 sshd[2383043]: Disconnected from invalid user testuser 165.22.63.108 port 34190 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.35
country_id: 1605651
description:
Nov 17 12:53:59 host2 pure-ftpd[2383297]: (?@103.176.152.35) [INFO] New connection from 103.176.152.35


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 13:12:07 host2 sshd[2394530]: Disconnected from invalid user tristian 62.60.131.157 port 40653 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 161.35.105.100
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 161.35.105.100: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-17 13:22:29 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:57538: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2025-11-17 13:22:59 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:50270: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.117.126
country_id: 6252001
description:
Nov 17 13:23:04 host2 pure-ftpd[2400393]: (?@40.124.117.126) [INFO] New connection from 40.124.117.126


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 13:23:33 host2 sshd[2400623]: Disconnected from invalid user user 2.57.121.25 port 47734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Nov 17 13:24:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, TLS, session=<OZgMqcVDXu2TuYRY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 17 13:25:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, session=<L83bq8VDIHFBMQFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.124
country_id: 6252001
description:
Nov 17 13:26:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<V6xOrsVD8ZxAPpx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 17 13:26:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lMFur8VDzvRAPpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 13:30:07 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:48972: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-17 13:29:37 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br ([152.237.221.1]) [187.40.215.162]:40532: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.216.121.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.216.121.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.131.193.125
country_id: 6252001
description:
Nov 17 13:41:54 host2 pure-ftpd[2411691]: (?@45.131.193.125) [INFO] New connection from 45.131.193.125


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.158
country_id: 6252001
description:
Nov 17 13:44:39 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.158, lip=66.85.158.91, session=<gR5L8MVD3JUSYROe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.175
country_id: 6252001
description:
Nov 17 13:48:39 host2 sshd[2416440]: Invalid user cloudtourssrilan_travel from 124.198.132.175 port 59510


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:49:29 host2 sshd[2417068]: Disconnected from invalid user kafka 188.166.156.169 port 49812 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.212
country_id: 2635167
description:
Nov 17 13:50:20 host2 pure-ftpd[2418129]: (?@87.236.176.212) [INFO] New connection from 87.236.176.212


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:52:56 host2 sshd[2419629]: Disconnected from invalid user ftptest 188.166.156.169 port 38368 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 13:53:39 host2 sshd[2420068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:55:12 host2 sshd[2421694]: Disconnected from invalid user joris 188.166.156.169 port 46708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:57:28 host2 sshd[2423146]: Disconnected from invalid user test1 188.166.156.169 port 42706 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.131.193.125
country_id: 6252001
description:
Nov 17 13:58:57 host2 pure-ftpd[2423939]: (?@45.131.193.125) [INFO] New connection from 45.131.193.125


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Nov 17 13:59:37 host2 sshd[2424456]: Disconnected from invalid user es 188.166.156.169 port 42786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-17 14:02:04 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:64220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.241.68
country_id: 2264397
description:
2025-11-17 14:02:53 dovecot_login authenticator failed for ([93.102.241.68]) [93.102.241.68]:59405: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-11-17 14:03:05 dovecot_login authenticator failed for ([208.69.161.7]) [208.69.161.7]:42514: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 14:02:15 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:19011: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 14:02:27 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:37081: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-11-17 14:06:47 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:37914: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-17 14:07:10 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:38092: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.152.146
country_id: 6252001
description:
Nov 17 14:16:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 26 secs): user=<>, rip=164.90.152.146, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hj/eYsZDyJukWpiS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.152.146
country_id: 6252001
description:
Nov 17 14:17:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.152.146, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<raqtZMZDPLakWpiS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:18:32 host2 sshd[2435625]: Disconnected from invalid user sanjay 35.199.95.142 port 58860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.247
country_id: 6252001
description:
Nov 17 14:20:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.247, lip=66.85.158.92, TLS, session=<nkYLb8ZDXvfG6xj3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.138
country_id: 130758
description:
Nov 17 14:22:16 host2 sshd[2437854]: Invalid user lankaherbalsolutions from 62.60.131.138 port 58386


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.22.151.143
country_id: 2802361
description:
Nov 17 14:24:25 host2 pure-ftpd[2439057]: (?@34.22.151.143) [INFO] New connection from 34.22.151.143


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:24:25 host2 sshd[2439048]: Disconnected from invalid user l4d2 35.199.95.142 port 32914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:25:45 host2 sshd[2440078]: Disconnected from invalid user admin 35.199.95.142 port 33476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:27:09 host2 sshd[2440943]: Disconnected from invalid user josh 35.199.95.142 port 34042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 14:27:46 host2 sshd[2441277]: Disconnected from invalid user tristian 62.60.131.157 port 56071 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Nov 17 14:31:32 host2 sshd[2443840]: Disconnected from invalid user mithun 35.199.95.142 port 35748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-11-17 14:35:06 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:57911: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.245.118
country_id: 617790
description:
2025-11-17 14:34:46 dovecot_login authenticator failed for (static.77.89.245.118.tmg.md) [77.89.245.118]:59548: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 14:35:23 host2 sshd[2446603]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:35:17 host2 sshd[2446521]: Disconnected from invalid user a 159.138.130.139 port 37786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 17 14:36:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7HoMqMZDsGdChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:36:53 host2 sshd[2447446]: Disconnected from invalid user online 159.138.130.139 port 48908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:38:21 host2 sshd[2448415]: Disconnected from invalid user jorge 159.138.130.139 port 33746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.138.130.139
country_id: 1819730
description:
Nov 17 14:39:45 host2 sshd[2449170]: Disconnected from invalid user composeruser 159.138.130.139 port 54860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.12.128
country_id: 1227603
description:
Nov 17 14:50:29 host2 dovecot[3661788]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=103.87.12.128, lip=66.85.158.91, TLS handshaking, session=<cC2528ZDkw9nVwyA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.12.128
country_id: 1227603
description:
Nov 17 14:53:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 149 secs): user=<>, rip=103.87.12.128, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<Cms26MZDJTtnVwyA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-17 14:57:51 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:39226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 15:03:00 host2 sshd[2464611]: Disconnected from invalid user user 2.57.121.25 port 33912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.43
country_id: 1880251
description:
Nov 17 15:06:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.99.35.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h7tEFsdDs9SLYyMr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 17 15:07:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<NgujF8dD26GLYyMq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.254.128
country_id: 1522867
description:
2025-11-17 15:31:21 dovecot_login authenticator failed for 2.135.254.128.dynamic.telecom.kz [2.135.254.128]:49475: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 15:31:51 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:50872: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 15:47:18 host2 sshd[2495819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 17 15:52:51 host2 pure-ftpd[2499583]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.238.108.130
country_id: 1269750
description:
2025-11-17 15:58:24 dovecot_plain authenticator failed for ([89.116.164.85]) [103.238.108.130]:10731: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.0.217.215
country_id: 3508796
description:
2025-11-17 15:58:36 dovecot_plain authenticator failed for ([89.116.164.85]) [148.0.217.215]:36561: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Nov 17 15:59:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.148, lip=66.85.158.91, TLS: Connection closed, session=<yQ/Y0MdDoqvHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.90.135.224
country_id: 6290252
description:
2025-11-17 15:58:11 dovecot_plain authenticator failed for ([89.116.164.85]) [185.90.135.224]:36740: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.41.119.155
country_id: 2077456
description:
2025-11-17 16:00:45 dovecot_plain authenticator failed for n1-41-119-155.mas21.nsw.optusnet.com.au ([89.116.164.85]) [1.41.119.155]:44574: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.10.195.240
country_id: 1210997
description:
2025-11-17 16:01:00 dovecot_plain authenticator failed for ([89.116.164.85]) [103.10.195.240]:45118: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.183.114.63
country_id: 3625428
description:
2025-11-17 16:01:12 dovecot_plain authenticator failed for ([89.116.164.85]) [38.183.114.63]:45196: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.23.230
country_id: 1282988
description:
2025-11-17 16:05:53 dovecot_plain authenticator failed for ([89.116.164.85]) [103.148.23.230]:64083: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.173.203.198
country_id: 3895114
description:
2025-11-17 16:06:06 dovecot_plain authenticator failed for ([89.116.164.85]) [181.173.203.198]:33078: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.173.203.198
country_id: 3895114
description:
2025-11-17 16:06:13 dovecot_login authenticator failed for ([89.116.164.85]) [181.173.203.198]:33078: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.36.78
country_id: 3469034
description:
2025-11-17 16:06:20 dovecot_plain authenticator failed for 191-5-36-78.sempre.tec.br ([89.116.164.85]) [191.5.36.78]:51653: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 16:07:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51524: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.25.71
country_id: 3469034
description:
2025-11-17 16:08:42 dovecot_plain authenticator failed for ([89.116.164.85]) [170.245.25.71]:64734: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.229.90.0
country_id: 1269750
description:
2025-11-17 16:08:48 dovecot_plain authenticator failed for ([89.116.164.85]) [43.229.90.0]:11585: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.155.130.155
country_id: 1269750
description:
2025-11-17 16:08:56 dovecot_plain authenticator failed for ([89.116.164.85]) [103.155.130.155]:41720: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 17 16:08:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<1Nfp8cdD/OdChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.163.157.190
country_id: 630336
description:
2025-11-17 16:08:19 dovecot_plain authenticator failed for ([89.116.164.85]) [178.163.157.190]:6147: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.171.50
country_id: 289688
description:
2025-11-17 16:08:28 dovecot_plain authenticator failed for ([89.116.164.85]) [78.101.171.50]:45954: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.177.2.5
country_id: 290557
description:
2025-11-17 16:08:34 dovecot_plain authenticator failed for ([89.116.164.85]) [109.177.2.5]:56288: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.194.243
country_id: 1269750
description:
2025-11-17 16:10:48 dovecot_plain authenticator failed for ([89.116.164.85]) [103.167.194.243]:24030: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.219.120.82
country_id: 1269750
description:
2025-11-17 16:11:02 dovecot_plain authenticator failed for ([89.116.164.85]) [106.219.120.82]:19592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.219.120.82
country_id: 1269750
description:
2025-11-17 16:11:09 dovecot_login authenticator failed for ([89.116.164.85]) [106.219.120.82]:19592: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.189.128.15
country_id: 6252001
description:
2025-11-17 16:11:14 dovecot_plain authenticator failed for ([89.116.164.85]) [23.189.128.15]:42752: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 17 16:14:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=<GVrHCMhDzL6nXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.126.128
country_id: 99237
description:
2025-11-17 16:19:23 dovecot_plain authenticator failed for ([89.116.164.85]) [212.237.126.128]:10586: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.130.190.135
country_id: 2077456
description:
2025-11-17 16:19:25 dovecot_plain authenticator failed for ([89.116.164.85]) [115.130.190.135]:54946: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.6.42.210
country_id: 6252001
description:
2025-11-17 16:19:35 dovecot_plain authenticator failed for 104-6-42-210.lightspeed.iplsin.sbcglobal.net ([89.116.164.85]) [104.6.42.210]:42363: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.209.3.246
country_id: 6252001
description:
2025-11-17 16:19:37 dovecot_plain authenticator failed for 69-209-3-246.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [69.209.3.246]:46072: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.21.220.40
country_id: 6252001
description:
2025-11-17 16:19:47 dovecot_plain authenticator failed for ([89.116.164.85]) [216.21.220.40]:45203: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 17 16:26:20 host2 sshd[2521178]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 55087


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.118.123.166
country_id: 6252001
description:
[2025-11-17 16:27:33 +0530] info [cpaneld] 75.118.123.166 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.188.32
country_id: 6252001
description:
[2025-11-17 16:27:42 +0530] info [cpaneld] 75.23.188.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.106.194
country_id: 6252001
description:
[2025-11-17 16:27:17 +0530] info [cpaneld] 67.84.106.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.127.54.132
country_id: 6252001
description:
[2025-11-17 16:27:23 +0530] info [cpaneld] 98.127.54.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.11.94.2
country_id: 6252001
description:
[2025-11-17 16:27:29 +0530] info [whostmgrd] 68.11.94.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.247.69.35
country_id: 6252001
description:
[2025-11-17 16:27:31 +0530] info [cpaneld] 76.247.69.35 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.241.108.225
country_id: 6252001
description:
Nov 17 16:27:48 host2 sshd[2521898]: Invalid user cloudtourssrilan_travel from 151.241.108.225 port 61390


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.75.146
country_id: 6252001
description:
[2025-11-17 16:27:15 +0530] info [cpaneld] 98.33.75.146 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 16:29:06 host2 sshd[2522608]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.86.215
country_id: 1269750
description:
2025-11-17 16:28:21 dovecot_plain authenticator failed for ([89.116.164.85]) [152.59.86.215]:46807: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.36.221.170
country_id: 102358
description:
2025-11-17 16:28:34 dovecot_plain authenticator failed for ([89.116.164.85]) [51.36.221.170]:4241: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.224.32.227
country_id: 99237
description:
2025-11-17 16:28:48 dovecot_plain authenticator failed for ([89.116.164.85]) [169.224.32.227]:31930: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 16:42:14 host2 sshd[2530206]: Disconnected from invalid user user 2.57.121.25 port 42095 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.52.150.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.52.150.178 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.80.19.23
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.80.19.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.108.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.129.108.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.179.87.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.179.87.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.84.224.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.84.224.209 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.249.137.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.249.137.210 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.40.49.140
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 38.40.49.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-17 17:20:55 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:34439: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-17 17:21:21 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60481: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 14.139.114.195
country_id: 1269750
description:
Nov 17 17:36:11 host2 pure-ftpd[2563367]: (?@14.139.114.195) [INFO] New connection from 14.139.114.195


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 17:36:55 host2 sshd[2563712]: Disconnected from invalid user user 2.57.121.25 port 37474 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 17:41:20 host2 sshd[2566100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 17:42:37 host2 sshd[2566592]: Disconnected from invalid user frankie 62.60.131.157 port 24419 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-17 17:46:35 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:49319: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 17:46:49 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57333: 535 Incorrect authentication data (set_id=hr)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 3.99.250.20
country_id: 6251999
description:
Denial of Service (DoS) attack was discovered from 3.99.250.20: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.223.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.189.223.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.22.81.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.22.81.36 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.246.245.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.246.245.248 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.101.227.2
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.101.227.2 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.85.123.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.85.123.160 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.187.208.150
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.187.208.150 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 17 17:53:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<qIDsaslDfNtChJmL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.12.22.98
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.12.22.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.239.246.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.239.246.29 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.222.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.144.222.92 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.28.114.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.28.114.13 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.145.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.145.123 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.131.90.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.131.90.101 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.167.214.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.167.214.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 18:02:19 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:61715: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 18:19:16 host2 sshd[2592490]: Disconnected from invalid user user 2.57.121.25 port 9412 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 18:23:17 host2 sshd[2594897]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-17 18:23:48 dovecot_login authenticator failed for ([50.171.241.234]) [50.171.241.234]:47646: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-17 18:24:17 dovecot_login authenticator failed for ([181.129.31.42]) [181.129.31.42]:59716: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-17 18:25:52 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:37681: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-17 18:26:11 dovecot_login authenticator failed for ([182.78.79.134]) [182.78.79.134]:54836: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:02 +0530] info [cpaneld] 136.116.91.180 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:04 +0530] info [webmaild] 136.116.91.180 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:07 +0530] info [whostmgrd] 136.116.91.180 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user root) has locked out IP 136.116.91.180


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-17 18:31:07 +0530] info [whostmgrd] 136.116.91.180 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user cloudtou) has locked out IP 136.116.91.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 17 18:33:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vfPw+MlD+mlChJl+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.129.143 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.126.131.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.126.131.176 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.90.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.202.90.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.18.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.57.18.111 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.105.180.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.105.180.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.170.212.225
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.170.212.225 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.180.110.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.180.110.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.227.224.196
country_id: 3469034
description:
Nov 17 18:46:37 host2 sshd[2609913]: Disconnected from invalid user samuel 168.227.224.196 port 31315 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:47:33 host2 sshd[2610334]: Disconnected from invalid user samuel 182.18.139.237 port 41246 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 17 18:49:00 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, TLS, session=<Bf+8MMpDmrzCpGsE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 17 18:52:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0+BPPcpDqdS594ko>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.177.178.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.177.178.20 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.160.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.160.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.205.183
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.33.205.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.213
country_id: 2635167
description:
Nov 17 18:52:30 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.213, lip=66.85.158.92, TLS, session=<CiVEPcpDmei594nV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:52:36 host2 sshd[2613250]: Disconnected from invalid user azure 182.18.139.237 port 33052 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.28
country_id: 690791
description:
2025-11-17 18:52:49 H=([45.144.212.28]) [45.144.212.28]:58493 F=<export@peak-ouyisports.com> rejected RCPT <info@ceylondigest.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.24.242.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.24.242.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.159.225.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.159.225.10 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 18:53:30 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:58529: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 17 18:53:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<qfBGQcpDjY6594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 17 18:53:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nEpLP8pDkcq594lI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.116.160.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.116.160.13 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.66
country_id: 2635167
description:
Nov 17 18:54:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.66, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<LmxCQ8pDSZNX7LBC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.40
country_id: 2635167
description:
Nov 17 18:54:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.40, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<vwE+RcpDiYa594ko>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:54:56 host2 sshd[2615209]: Disconnected from invalid user samara 182.18.139.237 port 54818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Nov 17 18:55:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7eQ2R8pD7cVX7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.72
country_id: 2635167
description:
Nov 17 18:55:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+A40ScpDU6lX7LBI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Nov 17 18:56:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.45, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<yG4vS8pDsbu594kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Nov 17 18:56:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<ecwoTcpDke1X7LAu>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.208.232
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.208.232 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 17 18:57:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<REUkT8pD2+i594lI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.246.39.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.246.39.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.195.82.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 134.195.82.111 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.250.217.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.250.217.210 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.146.208.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.146.208.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.98.148.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 207.98.148.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.194.134.173
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.194.134.173 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.12.247.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.12.247.216 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 18:59:23 host2 sshd[2618043]: Disconnected from invalid user owner 182.18.139.237 port 41902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 17 19:03:12 host2 sshd[2620952]: Invalid user visionsolutionshospital from 154.219.110.64 port 56756


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Nov 17 19:03:57 host2 sshd[2621368]: Disconnected from invalid user elasticsearch 182.18.139.237 port 57234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-17 19:05:44 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:38170: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-17 19:05:27 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:58534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 19:07:34 host2 sshd[2623396]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 19:09:18 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:64025: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-17 19:09:50 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:59928: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 19:10:28 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:38746: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.146.240.72
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.146.240.72 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.179.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.189.179.87 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.160.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.160.17 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.227.98.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.227.98.83 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.146.62.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.146.62.240 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.67.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.67.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.0.15.127
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.0.15.127 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.134.185.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.134.185.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.201.3.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.201.3.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.33.90.220
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.33.90.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.140.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.38.140.112 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.253.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 129.222.253.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.35.224.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.35.224.226 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.14.162.132
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 184.14.162.132 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.181.38
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.181.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.228.241.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.228.241.101 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.88.129.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.88.129.67 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.213.131
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.115.213.131 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.28.221
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.158.28.221 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.195.102.161
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.195.102.161 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 19:35:50 host2 sshd[2639605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.87.95.64
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.87.95.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.221.49.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.221.49.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.9.4.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.9.4.31 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.89.217.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.89.217.104 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.38.26.253
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.38.26.253 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.136.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.136.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.180.233
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.241.180.233 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Nov 17 19:43:56 host2 sshd[2643982]: Disconnected from invalid user abdullah 194.107.115.65 port 33888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Nov 17 19:45:18 host2 sshd[2645366]: Disconnected from invalid user jack 194.107.115.65 port 61510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 19:55:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56923: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 19:55:37 host2 sshd[2651512]: Disconnected from invalid user user 2.57.121.25 port 22110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 19:55:19 host2 sshd[2651331]: Disconnected from invalid user gianni 62.60.131.157 port 25930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-17 19:58:03 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2025-11-17 19:58:17 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-17 19:59:54 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:59209: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-17 19:59:39 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:49864: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.47.88
country_id: 6252001
description:
2025-11-17 20:07:35 dovecot_plain authenticator failed for ([10.143.41.218]) [143.244.47.88]:58288: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 20:07:45 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:60297: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov 17 20:12:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.49, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cXTOW8tDSdpbxJgx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.73
country_id: 3017382
description:
Nov 17 20:12:41 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.73, lip=66.85.158.91, TLS: Connection closed, session=<FoT+W8tDJeZbxJhJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 17 20:12:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZMpWWstDC6JbxJhN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.54
country_id: 3017382
description:
Nov 17 20:12:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.54, lip=66.85.158.91, TLS: Connection closed, session=<0UUCW8tD66NbxJg2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 20:18:03 host2 sshd[2664476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.200
country_id: 6252001
description:
Nov 17 20:30:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.200, lip=66.85.158.92, session=<+/PLnMtD91BAPpzI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 17 20:31:01 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<7o2SnctD2KVAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 17 20:31:13 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, session=<PcdHnstDzt1APpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov 17 20:31:49 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, session=<AA55oMtDwq5WNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 20:33:41 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:63033: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 20:49:22 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:60260: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 20:49:45 host2 sshd[2684836]: Disconnected from invalid user user 2.57.121.25 port 45904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-17 20:49:12 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:47640: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 17 21:05:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1nvTGMxDvrQzn+p2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 17 21:05:29 host2 pure-ftpd[2694976]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.236.249.111
country_id: 6252001
description:
2025-11-17 21:08:09 dovecot_plain authenticator failed for ec2-204-236-249-111.compute-1.amazonaws.com (EC2AMAZ-OO3Q294.ec2.internal) [204.236.249.111]:56580: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.229
country_id: 6252001
description:
Nov 17 21:11:59 host2 pure-ftpd[2698931]: (?@205.210.31.229) [INFO] New connection from 205.210.31.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-11-17 21:13:52 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:35262: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-17 21:13:14 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:58606: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-17 21:16:42 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:56730: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-17 21:16:59 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:57066: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 21:30:59 host2 sshd[2710027]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 21:31:38 host2 sshd[2710288]: Disconnected from invalid user user 2.57.121.25 port 47915 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 17 21:32:34 host2 pure-ftpd[2710955]: (?@198.235.24.101) [INFO] New connection from 198.235.24.101


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.229.138
country_id: 3194884
description:
Nov 17 21:37:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.229.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=</th3isxDkK2wfeWK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.36
country_id: 1668284
description:
Nov 17 21:37:14 host2 pure-ftpd[2714020]: (?@173.244.49.36) [INFO] New connection from 173.244.49.36


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.134
country_id: 1522867
description:
Nov 17 21:37:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.133.47.134, lip=66.85.158.91, TLS, session=<qXx+isxDkq0+hS+G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.247.34
country_id: 1562822
description:
Nov 17 21:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.247.34, lip=66.85.158.91, TLS handshaking: Connection closed, session=<E0+YisxDcqqt7/ci>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 223.252.16.146
country_id: 2077456
description:
Nov 17 21:37:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=223.252.16.146, lip=66.85.158.91, TLS, session=<LUWXisxDgqrf/BCS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.220.10
country_id: 3658394
description:
Nov 17 21:37:12 host2 pure-ftpd[2713998]: (?@173.239.220.10) [INFO] New connection from 173.239.220.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 17 21:53:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<CgXHwsxD2l24affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 17 21:53:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, TLS: Connection closed, session=<JQ+vw8xDfJ64affE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-11-17 21:54:36 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:38424: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-17 21:54:57 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:50751: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:03:57 host2 sshd[2743383]: Disconnecting authenticating user root 66.19.240.142 port 58044: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:03:57 host2 sshd[2743383]: error: maximum authentication attempts exceeded for root from 66.19.240.142 port 58044 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:14 host2 sshd[2743539]: Disconnecting authenticating user root 66.19.240.142 port 58152: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:14 host2 sshd[2743539]: error: maximum authentication attempts exceeded for root from 66.19.240.142 port 58152 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 17 22:04:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=<qpUB7MxDkpCUcdOD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.19.240.142
country_id: 6252001
description:
Nov 17 22:04:39 host2 sshd[2743707]: Disconnecting invalid user admin 66.19.240.142 port 58294: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 22:05:40 host2 sshd[2744590]: Disconnected from invalid user keagan 62.60.131.157 port 52905 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-11-17 22:11:28 dovecot_login authenticator failed for ([182.72.87.193]) [182.74.12.86]:57238: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-17 22:12:07 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:40328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 22:13:07 host2 sshd[2748857]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:13:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FvVuDc1DR8aTuYWM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:14:14 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ILKxDs1DvvaTuYWM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 17 22:20:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kvBPJc1DNnG4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 17 22:21:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<mVSlJ81DziS4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.140
country_id: 6252001
description:
Nov 17 22:21:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.140, lip=66.85.158.92, TLS, session=<JxBQKM1DvOmTuYWM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 17 22:31:36 host2 sshd[2764058]: Disconnected from invalid user freeswitch 51.158.152.220 port 41772 [preauth]


