# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:29:28 host2 sshd[2986626]: Disconnected from invalid user lch 160.242.96.43 port 49746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:29:46 host2 sshd[2986849]: Disconnected from invalid user testuser 154.91.81.176 port 58216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:30:51 host2 sshd[2988221]: Disconnected from invalid user es 160.242.96.43 port 60176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.251
country_id: 3625428
description:
Nov 25 23:31:40 host2 sshd[2988999]: Disconnected from invalid user usuario 38.134.226.251 port 41348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:31:52 host2 sshd[2989152]: Disconnected from invalid user jacob 154.91.81.176 port 56050 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.75
country_id: 6252001
description:
Nov 25 23:34:39 host2 pure-ftpd[2991992]: (?@195.184.76.75) [INFO] New connection from 195.184.76.75


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.79
country_id: 6252001
description:
Nov 25 23:34:39 host2 pure-ftpd[2991988]: (?@195.184.76.79) [INFO] New connection from 195.184.76.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.149
country_id: 3625428
description:
Nov 25 23:34:40 host2 sshd[2991994]: Disconnected from invalid user vpn 38.134.226.149 port 55720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.123
country_id: 3625428
description:
Nov 25 23:36:08 host2 sshd[2993770]: Disconnected from invalid user albert 38.134.226.123 port 34698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 23:35:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Sd2qH29E+nYvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:36:05 host2 sshd[2993695]: Disconnected from invalid user radio 154.91.81.176 port 51558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 23:40:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NFlDMW9EPp4v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:41:53 host2 sshd[2999637]: Disconnected from invalid user sales1 59.98.148.5 port 52848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:42:29 host2 sshd[3000303]: Disconnected from invalid user socks 81.30.162.18 port 36134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:43:22 host2 sshd[3001235]: Disconnected from invalid user pzuser 59.98.148.5 port 56106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 25 23:44:39 host2 sshd[3002485]: Invalid user visionsolutionshospital from 154.219.110.64 port 57114


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:44:51 host2 sshd[3002754]: Disconnected from invalid user sftpuser 59.98.148.5 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:46:08 host2 sshd[3004710]: Disconnected from invalid user airflow 196.0.120.211 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:46:10 host2 sshd[3004832]: Disconnected from invalid user zhangsan 154.221.17.254 port 52806 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 23:46:36 host2 sshd[3005273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Nov 25 23:47:11 host2 sshd[3005858]: Disconnected from invalid user tester 103.207.9.246 port 39626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:46:48 host2 sshd[3005437]: Disconnected from invalid user usuario1 103.157.25.60 port 49930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:47:39 host2 sshd[3006412]: Disconnected from invalid user ubuntu 59.98.148.5 port 41454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:47:19 host2 sshd[3006044]: Disconnected from invalid user test1 94.254.0.234 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:48:47 host2 sshd[3007447]: Disconnected from invalid user ubuntu 81.30.162.18 port 34661 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:50:12 host2 sshd[3008943]: Disconnected from invalid user user2 154.221.17.254 port 57522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 23:50:18 host2 sshd[3009041]: Disconnected from invalid user user 2.57.121.25 port 16645 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:49:18 host2 sshd[3007945]: Disconnected from invalid user developer 198.144.176.83 port 37772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-25 23:50:11 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:50608: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:49:45 host2 sshd[3008335]: Disconnected from invalid user guest 196.0.120.211 port 57530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:50:24 host2 sshd[3009155]: Disconnected from invalid user will 198.144.176.83 port 37378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-25 23:50:41 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:39634: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Nov 25 23:51:01 host2 sshd[3009720]: Disconnected from invalid user ubuntu 103.207.9.246 port 57536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:52:07 host2 sshd[3011021]: Disconnected from invalid user ftpadmin 103.157.25.60 port 53872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:51:50 host2 sshd[3010739]: Disconnected from invalid user blue 154.221.17.254 port 33898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:52:01 host2 sshd[3010889]: Disconnected from invalid user ubuntu 81.30.162.18 port 45254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:53:00 host2 sshd[3011852]: Disconnected from invalid user odoo15 189.126.4.42 port 41260 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:52:38 host2 sshd[3011533]: Disconnected from invalid user student 198.144.176.83 port 37428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.147
country_id: 3175395
description:
Nov 25 23:52:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.77.50.147, lip=66.85.158.91, TLS, session=<ovZdXW9EtqO5TTKT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:52:58 host2 sshd[3011802]: Disconnected from invalid user oracle 196.0.120.211 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:53:06 host2 sshd[3011999]: Disconnected from invalid user proradis 81.30.162.18 port 58193 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.48
country_id: 1269750
description:
Nov 25 23:53:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=202.136.85.48, lip=66.85.158.91, TLS, session=<IpqFXm9EbIfKiFUw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:53:34 host2 sshd[3012418]: Disconnected from invalid user localhost 103.157.25.60 port 55882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:54:17 host2 sshd[3013302]: Disconnected from invalid user kingbase 94.254.0.234 port 36088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:53:26 host2 sshd[3012309]: Disconnected from invalid user myuser 154.221.17.254 port 60128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:54:23 host2 sshd[3013710]: Disconnected from invalid user laravel 189.126.4.42 port 44010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:54:53 host2 sshd[3014356]: Disconnected from invalid user odoo15 103.157.25.60 port 57886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:54:58 host2 sshd[3014430]: Disconnected from invalid user master 154.221.17.254 port 38040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-25 23:55:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:48518: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:55:12 host2 sshd[3014824]: Disconnected from invalid user odoo15 94.254.0.234 port 52384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:56:10 host2 sshd[3015852]: Disconnected from invalid user test1 103.157.25.60 port 59900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:56:13 host2 sshd[3015926]: Disconnected from invalid user in 94.254.0.234 port 35842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-25 23:55:38 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:41652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:55:43 host2 sshd[3015375]: Disconnected from invalid user usuario1 189.126.4.42 port 46864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:00:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<37iMd29E/GEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-26 00:02:02 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:32836: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-11-26 00:02:30 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:54402: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 26 00:03:07 host2 pure-ftpd[3023541]: (?@194.164.107.4) [INFO] New connection from 194.164.107.4


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 26 00:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kfJ4hm9EPqov7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.250.60
country_id: 1605651
description:
Nov 26 00:04:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.194.250.60, lip=66.85.158.91, session=<pWWSiG9EjO12wvo8>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.194.250.60
country_id: 1605651
description:
Nov 26 00:04:44 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.194.250.60, lip=66.85.158.91, TLS, session=<+dejiG9EFO52wvo8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.14.197
country_id: 6252001
description:
Nov 26 00:07:12 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.14.197, lip=66.85.158.92, session=<dhZ1kW9EIestIQ7F>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "GET /login/?user=dmch@fhb.health.gov.lk HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:08:04 host2 sshd[3029579]: Disconnected from invalid user bodega 20.203.42.204 port 52558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:09:49 host2 sshd[3031254]: Disconnected from invalid user bodega 101.47.140.127 port 53044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:09:56 host2 sshd[3031342]: Disconnected from invalid user copia 20.203.42.204 port 57078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:11:15 host2 sshd[3032968]: Disconnected from invalid user postgres 20.203.42.204 port 60830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.144
country_id: 6252001
description:
Nov 26 00:11:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.144, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<bnkXoW9EOM7N0h+Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 26 00:13:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<4/fAp29E8uRHBpK6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.250.204.103
country_id: 1269750
description:
Nov 26 00:14:22 host2 sshd[3036513]: Disconnected from invalid user asterisk 160.250.204.103 port 36386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:14:48 host2 sshd[3036839]: Disconnected from invalid user ivan 101.47.140.127 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 00:15:06 host2 sshd[3037237]: Disconnected from invalid user user 2.57.121.25 port 31515 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.22
country_id: 6252001
description:
Nov 26 00:16:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lORps29EldvN0h8W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 00:17:39 host2 sshd[3039627]: Disconnected from invalid user marisol 2.57.121.112 port 62050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-26 00:21:58 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-26 00:22:08 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:59427: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:24:39 host2 sshd[3046188]: Disconnected from invalid user share 101.47.140.127 port 59038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:25:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xhhf0W9EVrkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 26 00:28:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<8I1I3W9E2usv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 00:38:21 host2 sshd[3060402]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-26 00:48:05 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:49128: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-26 00:48:39 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:37532: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:50:40 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MuTNLHBEUosvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:51:55 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:52:42 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:56:31 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 26 00:56:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lwClQnBERrxHBpK6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-26 01:04:17 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:46012: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-26 01:04:40 dovecot_login authenticator failed for ([58.169.37.163]) [58.169.37.163]:46224: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-11-26 01:05:21 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:35018: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 01:07:06 host2 sshd[3092295]: Disconnected from invalid user jailyn 62.60.131.157 port 25662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 01:09:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4On1b3BEVKIXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 01:09:52 host2 sshd[3095395]: Disconnected from invalid user user 2.57.121.25 port 40707 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 01:16:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xw2dh3BE3okvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 26 01:16:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<6srYiXBE/r1ChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:22:36 host2 sshd[3108915]: Disconnected from invalid user vpn 2.57.121.112 port 62170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-26 01:29:11 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:51057: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.221.217.130
country_id: 6252001
description:
Nov 26 01:31:08 host2 pure-ftpd[3118082]: (?@13.221.217.130) [INFO] New connection from 13.221.217.130


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.221.217.130
country_id: 6252001
description:
Nov 26 01:31:08 host2 pure-ftpd[3118088]: (?@13.221.217.130) [INFO] New connection from 13.221.217.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:33:08 host2 sshd[3119970]: Disconnected from invalid user admin 2.57.121.112 port 52931 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 01:34:20 host2 sshd[3121088]: Disconnected from invalid user user 2.57.121.25 port 53015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 01:34:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<XHs/yXBEKNcXXz9j>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.108
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.108: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 01:40:51 host2 sshd[3129876]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 01:41:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Xdxw43BExLEvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 26 01:43:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<7XV86HBEoGhChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 26 01:43:09 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, session=<SP+P6HBEomhChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Nov 26 01:48:15 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.91, session=<nnnY+nBElhes7OQm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.36.74
country_id: 2921044
description:
Nov 26 01:55:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.36.74, lip=66.85.158.92, session=<wrokFHFEm1po+CRK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.44.176
country_id: 2921044
description:
Nov 26 01:55:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.44.176, lip=66.85.158.92, session=<j+ArFHFEdJFo+Cyw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.17.117
country_id: 2300660
description:
Nov 26 01:57:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.139.17.117, lip=66.85.158.91, TLS, session=<Qbw5HHFETpgpixF1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.124
country_id: 6290252
description:
Nov 26 01:58:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.17.108.124, lip=66.85.158.91, TLS, session=<BpJxHXFENK/ZEWx8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:59:01 host2 sshd[3152301]: Disconnected from invalid user admin 2.57.121.112 port 33256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 02:06:40 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64690: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-26 02:07:37 dovecot_plain authenticator failed for (superfus) [46.8.245.34]:40150: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.48
country_id: 6252001
description:
Nov 26 02:07:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Xf5BQHFEi83N0h8w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 02:11:53 host2 sshd[3167552]: Disconnected from invalid user  2.57.121.112 port 62405 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-26 02:10:58 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:35306: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-26 02:18:54 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:52522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-26 02:19:04 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:40496: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.121
country_id: 3865483
description:
Nov 26 02:21:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=190.5.21.121, lip=66.85.158.91, TLS, session=<Ou3abnFEmJG+BRV5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.155.135.23
country_id: 3469034
description:
Nov 26 02:21:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.155.135.23, lip=66.85.158.91, TLS, session=<nxQtcHFENoKxm4cX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 02:28:44 host2 sshd[3184919]: Disconnected from invalid user user 2.57.121.25 port 11359 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 02:32:26 host2 sshd[3188844]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.206.147
country_id: 6252001
description:
Nov 26 02:32:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=181.41.206.147, lip=66.85.158.91, session=<vYa7mXFE4MO1Kc6T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 02:40:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<tXW1tnFEssQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-26 02:43:48 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:54834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.37.210
country_id: 1269750
description:
2025-11-26 02:43:53 dovecot_plain authenticator failed for (D5USN7IUSI1V) [49.37.37.210]:65044: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-26 02:44:06 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:58890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-26 02:48:29 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (tendenet) [68.52.119.193]:49594: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-26 02:49:16 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:56970: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-11-26 02:49:35 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:32789: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 26 02:51:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS: Connection closed, session=<5nB63XFEip7CpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 02:53:14 host2 sshd[3212898]: Disconnected from invalid user user 2.57.121.25 port 29400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 26 02:53:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<1wXZ5HFEmNlChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.144.100
country_id: 3865483
description:
Nov 26 02:55:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=181.16.144.100, lip=66.85.158.91, TLS, session=<rBb46XFE9Ka1EJBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.156
country_id: 1269750
description:
Nov 26 02:55:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.18.166.156, lip=66.85.158.91, TLS, session=<MOmc6HFEL7NnEqac>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Nov 26 02:56:17 host2 pure-ftpd[3217033]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-11-26 02:57:29 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:34394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.228
country_id: 6252001
description:
Nov 26 02:57:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.228, lip=66.85.158.92, TLS, session=<ig0P83FElPTG6xjk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.29
country_id: 2635167
description:
Nov 26 02:58:56 host2 pure-ftpd[3219588]: (?@185.247.137.29) [INFO] New connection from 185.247.137.29


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:05:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CWHuDnJEeJUXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.8.177
country_id: 6252001
description:
Nov 26 03:10:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.8.177, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<I0iAIHJEFKsv+wix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 26 03:10:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<G15LInJEOoAv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 26 03:10:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WYhqInJESIAv+zWT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 03:14:47 host2 sshd[3236501]: Disconnected from invalid user jayde 62.60.131.157 port 40025 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:14:49 host2 sshd[3236544]: Disconnected from invalid user tidb 103.218.240.181 port 55614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov 26 03:15:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DIRqMnJEmsLN0h/s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:16:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DiIpN3JEfMcXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.236
country_id: 6252001
description:
Nov 26 03:17:00 host2 pure-ftpd[3238587]: (?@198.235.24.236) [INFO] New connection from 198.235.24.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.56
country_id: 99237
description:
Nov 26 03:17:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=65.20.150.56, lip=66.85.158.91, TLS, session=<wYCfOXJENu1BFJY4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:18:31 host2 sshd[3239935]: Disconnected from invalid user g 103.218.240.181 port 60794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.193
country_id: 3469034
description:
Nov 26 03:18:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.129.193, lip=66.85.158.91, TLS, session=<ZYvJOnJEjMG/NYHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:19:51 host2 sshd[3241103]: Disconnected from invalid user soporte 103.218.240.181 port 56446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:21:12 host2 sshd[3242579]: Disconnected from invalid user aaa 103.218.240.181 port 46858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:22:29 host2 sshd[3243921]: Disconnected from invalid user test123 103.218.240.181 port 46584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 26 03:31:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<fkMzanJEntKSOC+J>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 03:34:47 host2 sshd[3256804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-26 03:35:44 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:36208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-26 03:36:04 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:52604: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:41:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<VjZCj3JEKLkXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.86
country_id: 6252001
description:
Nov 26 03:49:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.86, lip=66.85.158.92, session=<cwu/q3JEOokUqwhW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-26 03:59:43 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:53832: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.46
country_id: 6252001
description:
2025-11-26 04:00:03 dovecot_login authenticator failed for ([70.174.168.46]) [70.174.168.46]:43387: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:04:02 host2 sshd[3294365]: Disconnected from invalid user developer 46.101.1.180 port 42754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.203.224.88
country_id: 6252001
description:
Nov 26 04:05:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.203.224.88, lip=66.85.158.91, session=<beST5nJE9t6sy+BY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 04:05:34 host2 sshd[3296361]: Disconnected from invalid user  2.57.121.112 port 61201 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:06:43 host2 sshd[3297935]: Disconnected from invalid user userroot 46.101.1.180 port 42764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:08:42 host2 sshd[3300674]: Disconnected from invalid user odoo15 122.176.122.24 port 41078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:08:58 host2 sshd[3300981]: Disconnected from invalid user ftptest 46.101.1.180 port 42790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:10:04 host2 sshd[3302509]: Disconnected from invalid user vlad 46.101.1.180 port 42804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:10:16 host2 sshd[3302802]: Disconnected from invalid user deploy 122.176.122.24 port 43394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Nov 26 04:10:22 host2 sshd[3302960]: Disconnected from invalid user lch 45.169.128.70 port 60946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:11:08 host2 sshd[3303988]: Disconnected from invalid user admin123 46.101.1.180 port 42820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:13:35 host2 sshd[3307265]: Disconnected from invalid user autcom 122.176.122.24 port 47996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:14:29 host2 sshd[3308479]: Disconnected from invalid user student 157.10.160.91 port 56862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Nov 26 04:14:35 host2 sshd[3308593]: Disconnected from invalid user bitnami 45.169.128.70 port 44360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:16:42 host2 sshd[3311381]: Disconnected from invalid user ftptest 201.23.17.75 port 52542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 04:16:29 host2 sshd[3311028]: Disconnected from invalid user admin 2.57.121.112 port 9865 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:18:54 host2 sshd[3314271]: Disconnected from invalid user ts2 201.23.17.75 port 37904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:19:32 host2 sshd[3315126]: Disconnected from invalid user redmine 157.10.160.91 port 49236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:23:14 host2 sshd[3319775]: Disconnected from invalid user tempuser 201.23.17.75 port 48694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:23:17 host2 sshd[3319838]: Disconnected from invalid user cds 157.10.160.91 port 41204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:24:31 host2 sshd[3321851]: Disconnected from invalid user hello 157.10.160.91 port 51666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:25:15 host2 sshd[3323048]: Disconnected from invalid user posiflex 201.23.17.75 port 40958 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 04:26:17 host2 sshd[3324709]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 04:31:25 host2 sshd[3331045]: Disconnected from invalid user jill 62.60.131.157 port 8324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.69
country_id: 3077311
description:
Nov 26 04:34:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=217.75.222.69, lip=66.85.158.91, TLS, session=<oxDzSnNEyuXZS95F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.13.140.178
country_id: 3175395
description:
Nov 26 04:34:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.13.140.178, lip=66.85.158.91, TLS, session=<h/M0THNEZcwfDYyy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.165
country_id: 953987
description:
Nov 26 04:34:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.47.165, lip=66.85.158.91, TLS, session=<YmuSTHNEWotmQC+l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.10.70.126
country_id: 298795
description:
Nov 26 04:35:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=38.10.70.126, lip=66.85.158.91, TLS, session=<ijgkTnNEM9AmCkZ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.116
country_id: 3469034
description:
Nov 26 04:52:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=179.189.201.116, lip=66.85.158.91, TLS, session=<0T0ujHNEfNKzvcl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.43
country_id: 690791
description:
Nov 26 04:52:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.157.43, lip=66.85.158.91, TLS, session=<2HdyjXNE7O0l3Z0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.139
country_id: 6252001
description:
Nov 26 04:56:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qTpynXNEMsgSYROL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:15:01 host2 sshd[3388342]: Disconnected from invalid user tester 182.8.228.193 port 44847 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:15:11 host2 sshd[3388725]: Disconnected from invalid user ts3 103.186.0.68 port 48586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:20:22 host2 sshd[3395130]: Disconnected from invalid user ftptest 182.8.228.193 port 42990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:19:49 host2 sshd[3394339]: Disconnected from invalid user admin1234 103.186.0.68 port 41006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:22:35 host2 sshd[3397754]: Disconnected from invalid user vagrant 103.186.0.68 port 51718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:23:14 host2 sshd[3398661]: Disconnected from invalid user administrator 182.8.228.193 port 51778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:24:37 host2 sshd[3400547]: Disconnected from invalid user tecnopos 182.8.228.193 port 23708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:26:53 host2 sshd[3403696]: Disconnected from invalid user posiflex 103.80.27.53 port 37124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:27:16 host2 sshd[3404149]: Disconnected from invalid user deploy 154.125.83.31 port 41841 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 05:28:38 host2 sshd[3406069]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 05:28:48 host2 sshd[3406234]: Disconnected from invalid user user 2.57.121.25 port 22418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:33:36 host2 sshd[3411884]: Disconnected from invalid user dixi 154.125.83.31 port 36934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:34:56 host2 sshd[3413380]: Disconnected from invalid user deploy 103.80.27.53 port 44396 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 26 05:38:05 host2 pure-ftpd[3417530]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 05:38:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<rhnLMXREyKkXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:38:47 host2 sshd[3418213]: Disconnected from invalid user foundry 154.125.83.31 port 33291 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.250
country_id: 2510769
description:
Nov 26 05:40:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=139.28.190.250, lip=66.85.158.91, TLS, session=<NG/xNnRERcqLHL76>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.0
country_id: 690791
description:
Nov 26 05:40:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.2.0, lip=66.85.158.91, TLS, session=<gSgXOHRE7pWwZwIA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:40:49 host2 sshd[3420734]: Disconnected from invalid user guest 103.80.27.53 port 43186 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.96
country_id: 6252001
description:
Nov 26 05:41:54 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=20.163.15.96, lip=66.85.158.91, session=<g8twPnREHOIUow9g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Nov 26 05:41:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<gDRJPnRE+MrE+2Qw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.221.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 144.31.221.126 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:48:34 host2 sshd[3429035]: Disconnected from invalid user botuser 154.125.83.31 port 54129 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.121.84
country_id: 6252001
description:
Nov 26 05:49:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.235.121.84, lip=66.85.158.92, session=<tl9SWnRENrNK63lU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 05:53:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56232: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 05:54:31 host2 sshd[3435449]: Disconnected from invalid user kaylan 62.60.131.157 port 7726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 06:02:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CG7ciHRE6tAXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 06:03:21 host2 sshd[3442994]: Disconnected from invalid user int 154.125.83.31 port 35370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-26 06:05:19 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:56571: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-26 06:05:48 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:48749: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-26 06:06:30 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:37248: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-26 06:06:55 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:50096: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.181
country_id: 6252001
description:
Nov 26 06:08:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<E4efnnREssbG6xi1>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.42
country_id: 6251999
description:
Nov 26 06:13:40 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=86.54.31.42, lip=66.85.158.92, session=<UkEGsHREBJ5WNh8q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.42
country_id: 6251999
description:
Nov 26 06:13:42 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.42, lip=66.85.158.92, session=<Pm0jsHRETqZWNh8q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.128
country_id: 3469034
description:
Nov 26 06:14:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=179.106.87.128, lip=66.85.158.91, TLS, session=<sb0Zs3RED7izaleA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.37
country_id: 3658394
description:
Nov 26 06:15:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=201.182.148.37, lip=66.85.158.91, TLS, session=<9JVXtHREIbDJtpQl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.194.5
country_id: 2921044
description:
Nov 26 06:15:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=207.154.194.5, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gatHuHREXkDPmsIF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 06:20:15 host2 sshd[3456614]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 06:22:12 host2 sshd[3457834]: Disconnected from invalid user user 2.57.121.25 port 10061 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-11-26 06:24:31 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:55582: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-26 06:24:45 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:36982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 26 06:30:21 host2 sshd[3464018]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 63803


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.58
country_id: 6252001
description:
Nov 26 06:32:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.58, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NH6Z9HREj82TuYQ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.61.10.62
country_id: 3865483
description:
Nov 26 06:37:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=179.61.10.62, lip=66.85.158.91, TLS, session=<bOc6BHVE5q+zPQo+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.236
country_id: 690791
description:
Nov 26 06:37:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.5.236, lip=66.85.158.91, TLS, session=<JtxtBXVE9s+wZwXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.179.135
country_id: 2921044
description:
Nov 26 06:42:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.197.179.135, lip=66.85.158.92, TLS, session=<dvDZFnVE+CaKxbOH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.99
country_id: 2635167
description:
Nov 26 06:42:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.99, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7OZVF3VER8e594lj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Nov 26 06:42:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<sptaFXVELYpX7LBR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.242
country_id: 2635167
description:
Nov 26 06:41:59 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS, session=<fzFHFXVE+bxX7LDy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:42:44 host2 sshd[3473268]: Disconnected from invalid user update 43.154.60.193 port 41126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.98
country_id: 2635167
description:
Nov 26 06:43:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.98, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<m0RRGXVEbY+594li>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:43:26 host2 sshd[3473806]: Disconnected from invalid user sinusbot 144.48.8.10 port 40342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Nov 26 06:43:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<K51MG3VE47y594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.89
country_id: 2635167
description:
Nov 26 06:44:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.89, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9OFHHXVEddG594lZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.246
country_id: 6252001
description:
Nov 26 06:44:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.246, lip=66.85.158.91, TLS, session=<clA1HnVEpvTG6xj2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Nov 26 06:44:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CWJBH3VES4a594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 26 06:45:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<usg+IXVEr+q594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov 26 06:46:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<CHMzJXVEf+2594lS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:46:29 host2 sshd[3476397]: Disconnected from invalid user odoo 43.154.60.193 port 53234 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 26 06:45:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xQc6I3VEIcS594lV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:46:52 host2 sshd[3476720]: Disconnected from invalid user user01 144.48.8.10 port 35042 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Nov 26 06:46:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<FsQuJ3VET7JX7LBd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:47:51 host2 sshd[3477362]: Disconnected from invalid user aa 43.154.60.193 port 58746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:48:05 host2 sshd[3477528]: Disconnected from invalid user soporte 144.48.8.10 port 33520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:50:30 host2 sshd[3479391]: Disconnected from invalid user Test 43.154.60.193 port 35234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:50:23 host2 sshd[3479335]: Disconnected from invalid user hu 144.48.8.10 port 58740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:51:46 host2 sshd[3480267]: Disconnected from invalid user user01 43.154.60.193 port 41970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:52:41 host2 sshd[3480808]: Disconnected from invalid user devuser 144.48.8.10 port 55706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.63
country_id: 1210997
description:
2025-11-26 06:53:02 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.63]:46877: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 06:54:43 host2 sshd[3483046]: Disconnected from invalid user admin 2.57.121.112 port 12040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-11-26 06:59:40 dovecot_plain authenticator failed for (lentelly) [105.114.21.51]:35369: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.79
country_id: 6252001
description:
Nov 26 06:59:54 host2 pure-ftpd[3486430]: (?@205.210.31.79) [INFO] New connection from 205.210.31.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.60.115
country_id: 6252001
description:
2025-11-26 07:00:39 dovecot_login authenticator failed for wsip-68-225-60-115.pn.at.cox.net [68.225.60.115]:51682: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 07:05:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Dh/SanVEQOcXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:10:21 host2 sshd[3495048]: Disconnected from invalid user user1 45.78.223.11 port 59956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.100
country_id: 3175395
description:
Nov 26 07:11:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.15.171.100, lip=66.85.158.91, TLS, session=<klVsfXVE57+5D6tk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.51
country_id: 3277605
description:
Nov 26 07:11:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=188.246.73.51, lip=66.85.158.91, TLS, session=<JEaMfnVEK8289kkz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:15:06 host2 sshd[3499224]: Disconnected from invalid user openbravo 107.172.78.39 port 59576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:16:07 host2 sshd[3500021]: Disconnected from invalid user ubuntu 107.172.78.39 port 52238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:16:42 host2 sshd[3500423]: Disconnected from invalid user castle 45.78.223.11 port 59646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:19:23 host2 sshd[3502590]: Disconnected from invalid user ts3 45.78.223.11 port 60512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:20:31 host2 sshd[3503681]: Disconnected from invalid user redmine 107.172.78.39 port 39552 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 07:22:44 host2 sshd[3505384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 07:30:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DKdewXVEYpQXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:29:47 host2 sshd[3511143]: Disconnected from invalid user ionadmin 45.78.223.11 port 40882 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 26 07:30:15 host2 pure-ftpd[3511755]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.73
country_id: 2635167
description:
Nov 26 07:31:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.73, lip=66.85.158.92, TLS, session=<QOFwxnVEC5+594lJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.176
country_id: 3469034
description:
Nov 26 07:33:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.105.176, lip=66.85.158.91, TLS, session=<kPHvzXVEvpK7eGmw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 26 07:34:48 host2 sshd[3514858]: Disconnected from invalid user abhi 45.78.205.7 port 41374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.76
country_id: 3865483
description:
Nov 26 07:34:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=45.238.107.76, lip=66.85.158.91, TLS, session=<BNlIz3VE3eAt7mtM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-11-26 07:36:17 dovecot_login authenticator failed for ([202.74.192.200]) [202.74.192.200]:49819: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-26 07:36:59 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:59736: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.177
country_id: 1861060
description:
2025-11-26 07:37:20 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [138.199.39.177]:14627: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 07:39:04 host2 sshd[3518362]: Disconnected from invalid user user 2.57.121.25 port 49509 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 07:39:12 host2 sshd[3518511]: Disconnected from invalid user  2.57.121.112 port 62916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:42:51 host2 sshd[3521749]: Disconnected from invalid user hu 45.78.223.11 port 59140 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.137
country_id: 2635167
description:
Nov 26 07:51:11 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.137, lip=66.85.158.91, TLS, session=<rS7FDHZEv4O594mJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.83
country_id: 2635167
description:
Nov 26 07:51:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.83, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lhtBDXZEUcdX7LBT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov 26 07:51:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uRVGD3ZEf8RX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Nov 26 07:52:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lgdJEXZE85VX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Nov 26 07:52:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<4lk+E3ZEqYG594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.87
country_id: 2635167
description:
Nov 26 07:54:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.87, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GgI1F3ZEA6RX7LBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Nov 26 07:53:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<9XY7FXZEj6q594lQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.97
country_id: 2635167
description:
Nov 26 07:54:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.97, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<H8UyGXZEAZK594lh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov 26 07:55:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<zgMuG3ZEn9tX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Nov 26 07:56:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<PnskH3ZEkcG594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.65
country_id: 6252001
description:
Nov 26 08:01:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.65, lip=66.85.158.92, session=<uaG9MXZE5OnN0h9B>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.46
country_id: 1643084
description:
Nov 26 08:09:40 host2 sshd[3539559]: Invalid user cloudtourssrilan_travel from 182.8.226.46 port 40849


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.226.46
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.226.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-26 08:10:40 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:55116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-11-26 08:11:34 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:49430: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-26 08:11:49 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:53702: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-26 08:12:02 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:52358: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-26 08:12:26 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:47043: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 08:12:43 host2 sshd[3541673]: Disconnected from invalid user admin 2.57.121.112 port 40901 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:12:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<md2YWnZE0pkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:13:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eABQXHZEMOEDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 08:14:22 host2 sshd[3542783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:14:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<j7qwYXZEBOgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:15:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5VRnY3ZEcuMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:17:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<K6F+aXZEwOYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:18:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XUi8bnZEeJEDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.46
country_id: 1643084
description:
Nov 26 08:18:38 host2 sshd[3545290]: Invalid user cloudtourssrilan_travel from 182.8.226.46 port 61506


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3OcWc3ZEltMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:20:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<GrtadXZEvqgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.230
country_id: 2510769
description:
Nov 26 08:21:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=185.74.240.230, lip=66.85.158.91, TLS, session=<ac57dnZEDrK5SvDm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.117.102
country_id: 226074
description:
Nov 26 08:21:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.117.102, lip=66.85.158.91, TLS, session=<etegd3ZE8a/EAHVm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.116
country_id: 6252001
description:
Nov 26 08:26:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.116, lip=66.85.158.91, TLS: Connection closed, session=<3vyGjHZEaMzHLZp0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 26 08:29:50 host2 sshd[3551955]: Disconnected from invalid user devuser 45.78.205.7 port 55918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-26 08:33:20 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:56282: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-26 08:33:44 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:37082: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.249.178.45
country_id: 6252001
description:
Nov 26 08:33:55 host2 pure-ftpd[3554467]: (?@74.249.178.45) [INFO] New connection from 74.249.178.45


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 08:42:48 host2 sshd[3559913]: Disconnected from invalid user  2.57.121.112 port 61831 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-26 08:48:19 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:39033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-26 08:50:38 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:54940: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.150
country_id: 690791
description:
Nov 26 08:51:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=176.103.0.150, lip=66.85.158.91, TLS, session=<yejR4XZE6LawZwCW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.197
country_id: 2300660
description:
Nov 26 08:51:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.5.197, lip=66.85.158.91, TLS, session=<EOb14nZENa4piwXF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 145.220.0.84
country_id: 2750405
description:
Nov 26 08:52:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share (no auth attempts in 0 secs): user=<>, rip=145.220.0.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share, session=<erT05nZEbMiR3ABU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Nov 26 08:52:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.91, session=<vIcx6XZETOzG6xjo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-26 08:57:34 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:42158: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-11-26 08:57:54 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:51730: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.167.160
country_id: 99237
description:
Nov 26 09:06:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=65.20.167.160, lip=66.85.158.91, TLS, session=<hWkcGXdE8LdBFKeg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.112
country_id: 798544
description:
Nov 26 09:07:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr>, method=PLAIN, rip=46.20.58.112, lip=66.85.158.91, TLS, session=<MImZGndEub4uFDpw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.182.223
country_id: 1282988
description:
2025-11-26 09:08:39 dovecot_plain authenticator failed for (Q171B58071) [103.163.182.223]:31326: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 09:16:54 host2 sshd[3584632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 26 09:19:40 host2 sshd[3586187]: Invalid user visionsolutionshospital from 154.219.110.64 port 59378


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 43 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X09ubndEH8qi2JY9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:30:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zit2b3dE1vOi2JY9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.187.95
country_id: 2510769
description:
Nov 26 09:33:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=5.183.187.95, lip=66.85.158.91, TLS, session=<okhse3dED40Ft7tf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.211
country_id: 3175395
description:
Nov 26 09:34:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.211, lip=66.85.158.91, TLS, session=<clWDfHdEMq2rFuvT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:35:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS, session=<r07SgHdEvOSi2JY9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 09:36:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54893: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.138
country_id: 2635167
description:
Nov 26 09:42:50 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.138, lip=66.85.158.92, TLS, session=<CrUOnHdEh8i594mK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:47:20 host2 sshd[3605460]: Disconnected from invalid user steam 103.143.238.207 port 47274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 09:47:24 host2 sshd[3605479]: Disconnected from invalid user superadmin 45.78.200.2 port 47764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:48:04 host2 sshd[3605916]: Disconnected from invalid user jrodrig 92.207.4.157 port 32832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 26 09:50:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=</V7etXdESGanXpI/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:50:11 host2 sshd[3607592]: Disconnected from invalid user mc 92.207.4.157 port 42022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 09:50:47 host2 sshd[3607980]: Disconnected from invalid user minecraft 45.78.200.2 port 39476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:51:02 host2 sshd[3608224]: Disconnected from invalid user guest123 103.143.238.207 port 57316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 26 09:50:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<sAQ9tndEimanXpI/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:51:22 host2 sshd[3608391]: Disconnected from invalid user guest123 92.207.4.157 port 41194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:53:12 host2 sshd[3609575]: Disconnected from invalid user qwerty 103.143.238.207 port 54660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:53:34 host2 sshd[3609794]: Disconnected from invalid user debianuser 92.207.4.157 port 39542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:54:28 host2 sshd[3610741]: Disconnected from invalid user gitea 165.154.1.18 port 53276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 26 09:55:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9/cAyndEwNoDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:56:16 host2 sshd[3612329]: Disconnected from invalid user es 165.154.1.18 port 35334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:56:26 host2 sshd[3612439]: Disconnected from invalid user teamspeak 103.143.238.207 port 50690 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 26 09:56:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<5NGyy3dEUqADjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:59:31 host2 sshd[3614510]: Disconnected from invalid user github 165.154.1.18 port 53554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 10:01:29 host2 sshd[3615481]: Disconnected from invalid user gitea 45.78.200.2 port 56714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.120.168
country_id: 3865483
description:
Nov 26 10:02:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.181.120.168, lip=66.85.158.91, TLS, session=<i1yP4ndEV5u+tXio>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 10:02:54 host2 sshd[3617221]: Disconnected from invalid user es 45.78.200.2 port 33922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.75
country_id: 99237
description:
Nov 26 10:02:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=65.20.136.75, lip=66.85.158.91, TLS, session=<lNFb4XdEFaBBFIhL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.231
country_id: 3017382
description:
Nov 26 10:03:41 host2 pure-ftpd[3618069]: (?@91.196.152.231) [INFO] New connection from 91.196.152.231


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.158
country_id: 3017382
description:
Nov 26 10:03:41 host2 pure-ftpd[3618064]: (?@91.196.152.158) [INFO] New connection from 91.196.152.158


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 10:08:40 host2 sshd[3621659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:09:10 host2 sshd[3621984]: Disconnected from invalid user shiny 103.176.79.117 port 33766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:09:52 host2 sshd[3622421]: Disconnected from invalid user stack 125.21.53.232 port 39840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:09:55 host2 sshd[3622445]: Disconnected from invalid user stperez 101.36.119.50 port 60434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 26 10:10:20 host2 sshd[3623043]: Disconnected from invalid user taibabi 107.174.26.130 port 44926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:11:52 host2 sshd[3624014]: Disconnected from invalid user tuan 190.167.237.191 port 58266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:11:40 host2 sshd[3623764]: Disconnected from invalid user testuser 103.176.79.117 port 33324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.98.101
country_id: 3469034
description:
2025-11-26 10:11:51 dovecot_login authenticator failed for (186-236-98-101.ntelecom.com.br) [186.236.98.101]:38311: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:12:24 host2 sshd[3624324]: Disconnected from invalid user desliga 125.21.53.232 port 60054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-26 10:12:30 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:46326: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:13:50 host2 sshd[3625255]: Disconnected from invalid user hadoop 190.167.237.191 port 47264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:13:34 host2 sshd[3625088]: Disconnected from invalid user ubuntu 125.21.53.232 port 52508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Nov 26 10:14:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8c+2DnhErMjN0h8m>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:15:05 host2 sshd[3626143]: Disconnected from invalid user taibabi 190.167.237.191 port 57710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 10:14:09 host2 sshd[3625433]: Disconnected from invalid user houston 62.60.131.157 port 14565 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:14:46 host2 sshd[3625815]: Disconnected from invalid user django 125.21.53.232 port 36602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:15:49 host2 sshd[3626629]: Disconnected from invalid user amssys 103.63.25.203 port 60434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:16:05 host2 sshd[3626808]: Disconnected from invalid user ali 101.36.119.50 port 49704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 26 10:16:32 host2 sshd[3627123]: Disconnected from invalid user django 107.174.26.130 port 45682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:17:17 host2 sshd[3627717]: Disconnected from invalid user samba 103.176.79.117 port 33234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:17:19 host2 sshd[3627784]: Disconnected from invalid user superadmin 101.36.119.50 port 41884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:17:31 host2 sshd[3627909]: Disconnected from invalid user halo 190.167.237.191 port 45248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:19:11 host2 sshd[3629148]: Disconnected from invalid user dixi 103.63.25.203 port 43766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:19:34 host2 sshd[3629548]: Disconnected from invalid user nominatim 160.251.197.41 port 43870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:20:48 host2 sshd[3630736]: Disconnected from invalid user runner 103.63.25.203 port 56492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:25:38 host2 sshd[3634327]: Disconnected from invalid user sens 160.251.197.41 port 59150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-26 10:26:23 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (forly) [73.208.81.125]:33468: 535 Incorrect authentication data (set_id=chris@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:26:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YaPeOHhEwJoDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:27:42 host2 sshd[3635899]: Disconnected from invalid user deamon 160.251.197.41 port 47244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.192.129
country_id: 3865483
description:
Nov 26 10:27:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.96.192.129, lip=66.85.158.91, TLS, session=<+wYbPHhEAoK6YMCB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.140.92
country_id: 99237
description:
Nov 26 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.140.92, lip=66.85.158.91, TLS, session=<1+BUPXhEXdBBFIxc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:30:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<a3UtRXhEOIoDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:29:44 host2 sshd[3637402]: Disconnected from invalid user dixi 160.251.197.41 port 50300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:32:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YwR5THhE1r4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:33:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wQVWUXhE4OMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 10:33:55 host2 sshd[3640384]: Disconnected from invalid user moth3r 2.57.121.112 port 61611 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:35:34 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<wmKsWHhESNoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:37:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uycvXnhEZNADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:37:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wFO7YHhEhpEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.172
country_id: 3175395
description:
Nov 26 10:38:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=185.197.8.172, lip=66.85.158.91, TLS, session=<IeGjYHhED+q5xQis>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Nov 26 10:38:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<xwHMYXhECd4fs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.34.57
country_id: 3865483
description:
Nov 26 10:39:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.227.34.57, lip=66.85.158.91, TLS, session=<6MQdZXhEBtMt4yI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:39:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<rktxZnhEdrUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.218
country_id: 3175395
description:
Nov 26 10:39:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=185.15.170.218, lip=66.85.158.91, TLS, session=<rEKkZnhEuM65D6ra>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-26 10:41:21 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (acturs) [73.208.81.125]:45676: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.114
country_id: 6252001
description:
Nov 26 10:44:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.114, lip=66.85.158.91, TLS, session=<RPFCeHhEiOGTuYRy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.87
country_id: 690791
description:
Nov 26 10:49:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=37.221.147.87, lip=66.85.158.91, TLS, session=<qM/TinhE5cIl3ZNX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.156
country_id: 1269750
description:
Nov 26 10:50:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.58.65.156, lip=66.85.158.91, TLS, session=<YQbzi3hE6oVnOkGc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 26 10:58:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<w34Gq3hEGgunXpI4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 11:07:09 host2 sshd[3663752]: Disconnected from invalid user lamont 62.60.131.157 port 34199 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-26 11:10:16 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (fulinostic) [73.195.211.98]:35444: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 11:11:32 host2 sshd[3667024]: Disconnected from invalid user admin 2.57.121.112 port 9792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2025-11-26 11:13:05 dovecot_login authenticator failed for ([49.124.152.21]) [49.124.152.21]:48774: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-26 11:12:35 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:47814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:18:08 host2 sshd[3670905]: Disconnected from invalid user ubuntu 68.183.93.67 port 35052 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:19:31 host2 sshd[3671583]: Disconnected from invalid user abhi 68.183.93.67 port 38606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:22:03 host2 sshd[3673210]: Disconnected from invalid user halo 68.183.93.67 port 54046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:23:18 host2 sshd[3673912]: Disconnected from invalid user mcserver 68.183.93.67 port 55930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.142
country_id: 3175395
description:
Nov 26 11:23:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.142, lip=66.85.158.91, TLS, session=<Qh4wA3lEsZS5xQmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Nov 26 11:23:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<aZ4BAnlEu5Er5eEz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 11:30:48 host2 sshd[3678772]: Disconnected from invalid user lamont 62.60.131.157 port 64849 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 11:32:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<hWgwJXlEpIMXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:33:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xIN3KHlEfdQjy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:34:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<K1NALHlEzv8jy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:35:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 25 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<VWH6LXlE3P8jy9N7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-26 11:38:37 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:46764: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-11-26 11:38:30 dovecot_login authenticator failed for (comp148-211.2day.kz) [85.29.149.211]:48836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:41:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS, session=<7sn6QnlE7u0jy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:41:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS, session=<6UqLRXlEGOcjy9N7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.6.92
country_id: 953987
description:
Nov 26 11:45:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.66.6.92, lip=66.85.158.91, TLS, session=<PAADU3lEH5NmQgZc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.98.134
country_id: 3469034
description:
Nov 26 11:45:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=191.240.98.134, lip=66.85.158.91, TLS, session=<VHDIUXlECLe/8GKG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 11:52:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Ar1ZbXlE2qQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 11:57:05 host2 sshd[3699042]: Disconnected from invalid user student 103.52.115.25 port 54782 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 11:59:08 host2 sshd[3700528]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 11:58:12 host2 sshd[3699858]: Disconnected from invalid user old 103.67.78.102 port 59696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 11:58:34 host2 sshd[3700120]: Disconnected from invalid user hamed 103.52.115.25 port 47526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-26 12:00:17 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:47690: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-26 12:00:38 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:39340: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:00:49 host2 sshd[3702116]: Disconnected from invalid user sopuser 103.67.78.102 port 36526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:02:03 host2 sshd[3703011]: Disconnected from invalid user fan 103.67.78.102 port 53542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 12:01:17 host2 sshd[3702458]: Disconnected from invalid user user 103.52.115.25 port 37822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 12:02:48 host2 sshd[3703547]: Disconnected from invalid user testftp 103.52.115.25 port 35896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:04:51 host2 sshd[3705781]: Disconnected from invalid user qwerty 103.67.78.102 port 58264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.174
country_id: 798544
description:
Nov 26 12:16:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=178.219.98.174, lip=66.85.158.91, TLS, session=<IvpRv3lES7ey22Ku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.175
country_id: 3469034
description:
Nov 26 12:16:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.175, lip=66.85.158.91, TLS, session=<McNwwHlEupu+WYiv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.188.117
country_id: 6252001
description:
Nov 26 12:21:47 host2 pure-ftpd[3719458]: (?@44.220.188.117) [INFO] New connection from 44.220.188.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-26 12:23:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (radays) [87.103.126.54]:36493: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 12:23:51 host2 sshd[3720781]: Disconnected from invalid user reuben 62.60.131.157 port 17423 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 12:28:29 host2 sshd[3723804]: Disconnected from invalid user admin 2.57.121.112 port 47335 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Nov 26 12:31:30 host2 pure-ftpd[3725863]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 26 12:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<P/mt/XlEXH9ChJl2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 26 12:34:01 host2 pure-ftpd[3727399]: (?@18.222.201.82) [INFO] New connection from 18.222.201.82


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 26 12:34:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=18.222.201.82, lip=66.85.158.92, TLS handshaking: Connection closed, session=<38deAHpEmLAS3slS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-26 12:40:14 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:37412: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-26 12:40:49 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:50352: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:45:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<YB+hKXpERJUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:46:36 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<dSo+LXpEEtIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:47:54 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BJLwMXpEzs8DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:48:25 host2 sshd[3739297]: Disconnected from invalid user prueba 203.145.34.222 port 55394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-26 12:48:47 dovecot_plain authenticator failed for (nottante) [24.93.140.162]:35222: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:48:59 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<GLrENXpEUJsDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:49:48 host2 sshd[3740419]: Disconnected from invalid user ubuntu 203.145.34.222 port 35240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:49:53 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<jVkFOXpEJJwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<flxNPnpE4MwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.104
country_id: 3175395
description:
Nov 26 12:52:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.104, lip=66.85.158.91, TLS, session=<nNrHQXpEDJ3ZGrNo>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:52:56 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<UhDmQ3pEhrUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.177
country_id: 3469034
description:
Nov 26 12:52:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.72.177, lip=66.85.158.91, TLS, session=<bd6PQHpEDd27eEix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:52:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<7pbOQXpEkJcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ftmuR3pEKIcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.120.89
country_id: 1605651
description:
Nov 26 12:54:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.120.89, lip=66.85.158.92, session=<5t5ESHpEyKOlmnhZ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.120.89
country_id: 1605651
description:
Nov 26 12:54:10 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.120.89, lip=66.85.158.92, session=<oXpYSHpEmKSlmnhZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:53:37 host2 sshd[3743788]: Disconnected from invalid user www 203.145.34.222 port 44932 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:53:54 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<fX5fR3pEQsIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<etX/SnpEBqEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:12:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<PFvziXpENr0XXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 26 13:23:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, session=<mbYTsnpEBCRAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-26 13:25:21 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (cagnetkis) [68.82.141.145]:33258: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 13:25:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52296: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:29:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+Jc1xXpEFJwXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:33:49 host2 sshd[3778872]: Disconnected from invalid user django 202.137.222.34 port 48802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.42.136
country_id: 3469034
description:
Nov 26 13:35:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=170.80.42.136, lip=66.85.158.91, TLS, session=<o7F92npEkoGqUCqI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.33
country_id: 953987
description:
Nov 26 13:35:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.129.60.33, lip=66.85.158.91, TLS, session=<+TDO23pEx9pmgTwh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:35:53 host2 sshd[3780823]: Disconnected from invalid user backend 202.137.222.34 port 54224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:37:22 host2 sshd[3782148]: Disconnected from invalid user manager 202.137.222.34 port 51050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-26 13:37:31 dovecot_plain authenticator failed for (impureore) [64.72.74.162]:44868: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:40:19 host2 sshd[3784514]: Disconnected from invalid user casaos 202.137.222.34 port 34000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.235
country_id: 6252001
description:
Nov 26 13:41:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.91, TLS: Connection closed, session=<5a3t73pEsoJHBobr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.53
country_id: 6252001
description:
Nov 26 13:48:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.53, lip=66.85.158.92, TLS, session=<1+rjC3tEav3N0h81>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:50:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+HfNEntEerQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 14:03:30 host2 sshd[3804814]: Disconnected from invalid user antoinette 62.60.131.157 port 7235 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 14:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MLDJSXtE9uMXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.135
country_id: 6252001
description:
Nov 26 14:18:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.135, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aZopd3tEitmTuYSH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.41.47
country_id: 1819730
description:
Nov 26 14:23:00 host2 pure-ftpd[3821119]: (?@165.154.41.47) [INFO] New connection from 165.154.41.47


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 14:23:05 host2 sshd[3821196]: Disconnected from invalid user demo 2.57.121.112 port 61999 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.217.231
country_id: 3469034
description:
Nov 26 14:26:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=177.87.217.231, lip=66.85.158.91, TLS, session=<IBPgkXtEY9mxV9nn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.160
country_id: 798544
description:
Nov 26 14:26:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.160, lip=66.85.158.91, TLS, session=<bcAYk3tE+dEu4yeg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 14:28:11 host2 sshd[3824491]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-26 14:31:43 dovecot_plain authenticator failed for (anticingue) [178.250.191.189]:59260: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:34:39 host2 sshd[3828778]: Disconnected from invalid user zjw 162.240.212.247 port 43620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:38:19 host2 sshd[3831341]: Disconnected from invalid user free 162.240.212.247 port 59184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:39:43 host2 sshd[3832177]: Disconnected from invalid user ubuntu 162.240.212.247 port 33204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:41:04 host2 sshd[3833226]: Disconnected from invalid user postgres 162.240.212.247 port 35478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:43:05 host2 sshd[3834635]: Disconnected from invalid user g 45.78.197.104 port 51102 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.154.182
country_id: 1643084
description:
Nov 26 14:43:13 host2 pure-ftpd[3834774]: (?@152.32.154.182) [INFO] New connection from 152.32.154.182


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.232.175
country_id: 1605651
description:
Nov 26 14:43:22 host2 pure-ftpd[3834933]: (?@165.154.232.175) [INFO] New connection from 165.154.232.175


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:45:29 host2 sshd[3836830]: Disconnected from invalid user ubuntu 45.78.197.104 port 51522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-26 14:49:21 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (sessided) [67.173.58.47]:54080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:55:07 host2 sshd[3843648]: Disconnected from invalid user free 45.78.197.104 port 37284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.2
country_id: 3175395
description:
Nov 26 15:01:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@saara.lk>, method=PLAIN, rip=185.15.171.2, lip=66.85.158.91, TLS, session=<h9MrDXxEg+i5D6sC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 26 15:01:44 host2 pure-ftpd[3847706]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.196
country_id: 953987
description:
Nov 26 15:01:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.129.51.196, lip=66.85.158.91, TLS, session=<8YfJDnxE/uJmgTPE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.225
country_id: 6252001
description:
Nov 26 15:04:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.225, lip=66.85.158.92, session=<oznrGXxEE8jDuEzh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.1
country_id: 6252001
description:
Nov 26 15:04:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.1, lip=66.85.158.92, session=<dT+SGnxE053DuEwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Nov 26 15:04:38 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, session=<tabsGnxEx+LDuEzj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 15:06:05 host2 sshd[3851353]: Disconnected from invalid user admin 2.57.121.112 port 8110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.137.51.181
country_id: 1269750
description:
2025-11-26 15:06:46 dovecot_plain authenticator failed for (6S73LVD8) [38.137.51.181]:26056: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.203.157.226
country_id: 357994
description:
2025-11-26 15:13:42 dovecot_plain authenticator failed for (E43HFC1) [156.203.157.226]:49323: 535 Incorrect authentication data (set_id=accounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 15:15:29 host2 sshd[3857451]: Disconnected from invalid user admin 2.57.121.112 port 61467 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:16:29 host2 sshd[3857927]: Disconnected from invalid user gg 43.163.123.45 port 54840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 15:19:13 host2 sshd[3859697]: Disconnected from invalid user rayna 62.60.131.157 port 10974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-26 15:24:01 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:52128: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-26 15:23:34 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:41353: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:24:30 host2 sshd[3863309]: Disconnected from invalid user andy 43.163.123.45 port 38850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.174
country_id: 3469034
description:
Nov 26 15:25:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=190.89.136.174, lip=66.85.158.91, TLS, session=<dGflYnxE+sa+WYiu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.21
country_id: 2395170
description:
Nov 26 15:25:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=154.127.36.21, lip=66.85.158.91, TLS, session=<Y/bOZXxEVoGafyQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.116
country_id: 690791
description:
Nov 26 15:25:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.116, lip=66.85.158.91, TLS, session=<MR4gZHxEqdbCLIx0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.76
country_id: 3469034
description:
Nov 26 15:25:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=186.216.88.76, lip=66.85.158.91, TLS, session=<P3yiZHxEhYC62FhM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:25:41 host2 sshd[3864128]: Disconnected from invalid user cinema 43.163.123.45 port 37900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.242.78.9
country_id: 3469034
description:
Nov 26 15:26:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=191.242.78.9, lip=66.85.158.91, TLS, session=<Z0czZ3xEsdS/8k4J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.41
country_id: 3175395
description:
Nov 26 15:26:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.15.170.41, lip=66.85.158.91, TLS, session=<9pRuaHxECYO5D6op>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:26:58 host2 sshd[3864947]: Disconnected from invalid user astra 43.163.123.45 port 36958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:27:07 host2 sshd[3865052]: Disconnected from invalid user sipv 45.78.230.114 port 40206 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 15:29:13 host2 sshd[3866217]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:29:26 host2 sshd[3866279]: Disconnected from invalid user testuser 43.163.123.45 port 35072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:29:49 host2 sshd[3866459]: Disconnected from invalid user roots 45.78.230.114 port 56732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.137.84.161
country_id: 798544
description:
Nov 26 15:30:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@weeratrading.com>, method=PLAIN, rip=188.137.84.161, lip=66.85.158.91, TLS, session=<GYcBd3xEh5e8iVSh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.247
country_id: 3469034
description:
Nov 26 15:31:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.205.247, lip=66.85.158.91, TLS, session=<dk4deHxE37Kzvc33>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Nov 26 15:36:34 host2 sshd[3870248]: Disconnected from invalid user erpnext 202.51.214.98 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:40:25 host2 sshd[3872799]: Disconnected from invalid user casaos 45.78.230.114 port 47788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:41:09 host2 sshd[3873252]: Disconnected from invalid user daniel 83.229.122.23 port 37380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:45:08 host2 sshd[3875915]: Disconnected from invalid user andy 83.229.122.23 port 42168 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:46:29 host2 sshd[3876957]: Disconnected from invalid user student 83.229.122.23 port 36358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:49:00 host2 sshd[3878708]: Disconnected from invalid user abhi 83.229.122.23 port 53794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 26 15:53:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<yPeeyXxE8uiLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Nov 26 15:54:50 host2 sshd[3883241]: Disconnected from invalid user gerrit 207.166.174.63 port 59998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.166.174.63
country_id: 1880251
description:
Nov 26 16:00:12 host2 sshd[3886469]: Disconnected from invalid user deployer 207.166.174.63 port 33638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 16:11:19 host2 sshd[3894117]: Disconnected from invalid user sky 62.60.131.157 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 16:12:00 host2 sshd[3894458]: Disconnected from invalid user ionadmin 45.78.230.114 port 43438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 16:17:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JpqYH31EgucXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.249.127.147
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.249.127.147 - maximsholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.249.125.249
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.249.125.249 - maximsho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.193.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.193.31 - awanish@maximsholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.205.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.205.178 - maximsholdingsco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdingsco (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 16:20:11 host2 sshd[3900791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.158
country_id: 953987
description:
Nov 26 16:20:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.129.59.158, lip=66.85.158.91, TLS, session=<FalZKX1EsIhmgTue>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.151
country_id: 2510769
description:
Nov 26 16:20:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=139.28.190.151, lip=66.85.158.91, TLS, session=<UXu6Kn1EfL2LHL6X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.218
country_id: 3017382
description:
Nov 26 16:24:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.218, lip=66.85.158.92, session=<J04QOn1EYaBbxJja>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 16:25:05 host2 sshd[3903721]: Disconnected from invalid user admin 2.57.121.112 port 22741 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.190
country_id: 3017382
description:
Nov 26 16:24:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.190, lip=66.85.158.92, session=<0S9oOX1EA9BbxJi+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.190
country_id: 3017382
description:
Nov 26 16:25:09 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.190, lip=66.85.158.92, session=<d8PeOn1EKdpbxJi+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.218
country_id: 3017382
description:
Nov 26 16:25:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.218, lip=66.85.158.92, session=<SVERO31Ec+ZbxJja>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 16:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<jneDQH1E7osXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 16:36:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<ng6EY31EguFHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 16:36:32 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<wNuRY31EvuNHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-26 16:38:14 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:54456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-26 16:38:23 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:51309: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:41:38 host2 sshd[3915659]: Disconnected from invalid user root2 116.71.135.53 port 52298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:48:17 host2 sshd[3919829]: Disconnected from invalid user vbox 116.71.135.53 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:54:54 host2 sshd[3925708]: Disconnected from invalid user import 116.71.135.53 port 50142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.123.251
country_id: 3469034
description:
Nov 26 16:59:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=192.140.123.251, lip=66.85.158.91, TLS, session=<MRPhtX1Ew7bAjHv7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.89
country_id: 2300660
description:
Nov 26 17:00:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.11.89, lip=66.85.158.91, TLS, session=<Wnkht31E4b8piwtZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:05:07 host2 sshd[3932573]: Disconnected from invalid user suporte 104.248.17.208 port 57532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:07:42 host2 sshd[3934130]: Disconnected from invalid user system 79.61.112.234 port 50714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:08:11 host2 sshd[3934363]: Disconnected from invalid user test 162.241.87.197 port 32986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:09:06 host2 sshd[3935218]: Disconnected from invalid user bot 104.248.17.208 port 36106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:10:05 host2 sshd[3936094]: Disconnected from invalid user ajay 104.248.17.208 port 43134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:10:46 host2 sshd[3936468]: Disconnected from invalid user train1 79.61.112.234 port 55886 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:14:06 host2 sshd[3938839]: Disconnected from invalid user tv 79.61.112.234 port 54508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.235.18.24
country_id: 1269750
description:
Nov 26 17:14:21 host2 sshd[3938998]: Disconnected from invalid user github 172.235.18.24 port 35716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:15:17 host2 sshd[3939681]: Disconnected from invalid user aj 79.61.112.234 port 54052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 17:16:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58801: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:16:51 host2 sshd[3940559]: Disconnected from invalid user huawei 45.169.200.254 port 54154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:16:56 host2 sshd[3940597]: Disconnected from invalid user db2inst1 162.241.87.197 port 41244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 17:17:08 host2 sshd[3940691]: Disconnected from invalid user admin1 2.57.121.112 port 61410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:17:18 host2 sshd[3940814]: Disconnected from invalid user opc 45.78.203.124 port 57540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.105.176.66
country_id: 1269750
description:
Nov 26 17:17:34 host2 sshd[3940903]: Disconnected from invalid user github 103.105.176.66 port 54306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.235.18.24
country_id: 1269750
description:
Nov 26 17:19:04 host2 sshd[3941624]: Disconnected from invalid user gitea 172.235.18.24 port 34948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:18:10 host2 sshd[3941199]: Disconnected from invalid user ubuntu 162.241.87.197 port 59538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Nov 26 17:18:51 host2 sshd[3941504]: Disconnected from invalid user tecnopos 103.105.176.66 port 53840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-11-26 17:19:19 dovecot_plain authenticator failed for (haline) [65.20.133.4]:55555: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 17:19:23 host2 sshd[3941807]: Disconnected from invalid user admin 2.57.121.112 port 22462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-26 17:19:24 dovecot_plain authenticator failed for (aggial) [24.104.225.201]:57783: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:19:29 host2 sshd[3941850]: Disconnected from invalid user ubuntu 162.241.87.197 port 41496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:19:44 host2 sshd[3942019]: Disconnected from invalid user nrk 45.169.200.254 port 51648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:20:50 host2 sshd[3943051]: Disconnected from invalid user user 162.241.87.197 port 38196 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 17:21:25 host2 sshd[3943521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:22:23 host2 sshd[3943978]: Disconnected from invalid user manager 45.169.200.254 port 49128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.198.43.206
country_id: 6252001
description:
Nov 26 17:25:04 host2 sshd[3945487]: Disconnected from invalid user precio01 104.198.43.206 port 39234 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 26 17:25:42 host2 pure-ftpd[3946121]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.198.43.206
country_id: 6252001
description:
Nov 26 17:26:39 host2 sshd[3946910]: Disconnected from invalid user bitnami 104.198.43.206 port 49708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:27:36 host2 sshd[3947821]: Disconnected from invalid user q 45.78.203.124 port 43180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.3.96.178
country_id: 3175395
description:
Nov 26 17:33:12 host2 sshd[3951862]: Disconnected from invalid user admin 79.3.96.178 port 49680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:38:04 host2 sshd[3955751]: Disconnected from invalid user min 45.78.203.124 port 51610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.150
country_id: 2510769
description:
Nov 26 17:45:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@saara.lk>, method=PLAIN, rip=139.28.190.150, lip=66.85.158.91, TLS, session=<W6yBWn5En7KLHL6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.50
country_id: 3469034
description:
Nov 26 17:46:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.130.50, lip=66.85.158.91, TLS, session=<nln1W35EC96/NYIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 17:48:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JFtSZX5EwoQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.113
country_id: 3469034
description:
Nov 26 17:49:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.72.113, lip=66.85.158.91, TLS, session=<V0LiZX5ETZW7eEhx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.49.95.30
country_id: 3469034
description:
Nov 26 17:49:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.49.95.30, lip=66.85.158.91, TLS, session=<oSspZ35EU5OzMV8e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 17:50:21 host2 sshd[3967014]: Disconnected from invalid user layne 62.60.131.157 port 24438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:52:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<OS/RdH5E/KMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 17:54:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Xl2seH5EMtQXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:54:08 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<7MgceX5EkrUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-26 17:56:04 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (oventivil) [73.183.74.177]:51852: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:55:35 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<egpHfn5EOqoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:56:45 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<11Z3gn5Eko8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:57:20 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<58WJhH5EcswDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:58:33 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<o/jpiH5EruoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:00:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nT+Lj35EFLoDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:00:30 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ofPaj35EqoYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:01:43 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<trg6lH5EsKsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:02:10 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<sjrMlX5E8LwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:03:22 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<GhcXmn5E2tQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-26 18:08:57 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (dinelizes) [71.62.34.216]:36180: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 18:12:22 host2 sshd[3983957]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.100.80.112
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.100.80.112 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.25
country_id: 3175395
description:
Nov 26 18:22:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=217.26.178.25, lip=66.85.158.91, TLS, session=<EWqY3H5EKZjZGrIZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.239.246
country_id: 798544
description:
Nov 26 18:22:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.239.246, lip=66.85.158.91, TLS, session=<hqXB3X5EUa5tfe/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.213
country_id: 3469034
description:
Nov 26 18:28:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=191.53.107.213, lip=66.85.158.91, TLS, session=<3rfv8X5EN5S/NWvV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.33
country_id: 690791
description:
Nov 26 18:28:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.103.5.33, lip=66.85.158.91, TLS, session=<PWu5835EVNawZwUh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 18:42:29 host2 sshd[4002980]: Disconnected from invalid user iyana 62.60.131.157 port 24628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.33
country_id: 3865483
description:
Nov 26 18:57:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.64.95.33, lip=66.85.158.91, TLS, session=<Wj6OWX9EuZO6QF8h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Nov 26 18:57:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<MB3XWn9E54FBFI/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.201
country_id: 3865483
description:
Nov 26 18:57:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=190.5.21.201, lip=66.85.158.91, TLS, session=<QEajW39ENNO+BRXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.116
country_id: 3469034
description:
Nov 26 18:58:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=168.0.224.116, lip=66.85.158.91, TLS, session=<AongXH9EF7uoAOB0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 19:05:54 host2 sshd[4018460]: Disconnected from invalid user iyana 62.60.131.157 port 47787 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 26 19:06:18 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.238, lip=66.85.158.91, TLS, session=<yycpe39EVadX7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 19:07:40 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<WnMXgH9E5M5HBpKC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 19:07:40 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<xzEVgH9EmM1HBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 26 19:08:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eFhHhH9EupC4affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.31
country_id: 6252001
description:
Nov 26 19:09:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EGsphX9EnclBMQEf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 26 19:09:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OgF1hX9EUJy4affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 26 19:09:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<g8Blhn9ELp5BMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.46.170.61
country_id: 798544
description:
Nov 26 19:11:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=185.46.170.61, lip=66.85.158.91, TLS, session=<oGD/jH9EIoi5Lqo9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.147
country_id: 798544
description:
Nov 26 19:11:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.30.147, lip=66.85.158.91, TLS, session=<IpwPjn9EtsOy2B6T>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 19:14:00 host2 sshd[4023577]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-26 19:15:34 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:60282: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.101.69
country_id: 3144096
description:
2025-11-26 19:15:49 dovecot_login authenticator failed for (cm-46.212.101.69.get.no) [46.212.101.69]:35499: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.199.29.4
country_id: 798544
description:
Nov 26 19:15:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr>, method=PLAIN, rip=109.199.29.4, lip=66.85.158.91, TLS, session=<h91TnH9EiIVtxx0E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.165
country_id: 99237
description:
Nov 26 19:15:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=65.20.205.165, lip=66.85.158.91, TLS, session=<7Dnpmn9EtctBFM2l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.5.209
country_id: 2395170
description:
Nov 26 19:17:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.74.5.209, lip=66.85.158.91, TLS, session=<dQHroX9ElrgpSgXR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.107
country_id: 3469034
description:
Nov 26 19:17:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.209.246.107, lip=66.85.158.91, TLS, session=<gJ+ro39EWZ+60fZr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-26 19:35:21 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:52036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-11-26 19:36:10 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:54105: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-26 19:36:31 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:39921: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.221.176
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.42.221.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-26 19:40:03 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:45359: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-26 19:39:46 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:43973: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.132.202.50
country_id: 719819
description:
Nov 26 19:40:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=45.132.202.50, lip=66.85.158.91, TLS, session=<BQEy9n9E2OYthMoy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.245.13.242
country_id: 1269750
description:
Nov 26 19:41:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=43.245.13.242, lip=66.85.158.91, TLS, session=<rbVU939Etrwr9Q3y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-26 19:45:12 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (pance) [71.224.169.28]:51084: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.239.45.10
country_id: 1269750
description:
Nov 26 19:49:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=117.239.45.10, lip=66.85.158.91, TLS, session=<l+JvFIBEEsx17y0K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.255.196.103
country_id: 2413451
description:
Nov 26 19:49:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr>, method=PLAIN, rip=197.255.196.103, lip=66.85.158.91, session=<TVoqFoBEtc/F/8Rn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.72.153.110
country_id: 290557
description:
Nov 26 19:50:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=91.72.153.110, lip=66.85.158.91, TLS, session=<Bpl0FoBENs5bSJlu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.85.208.4
country_id: 798544
description:
Nov 26 19:51:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=45.85.208.4, lip=66.85.158.91, TLS, session=<QE+1GoBEF+0tVdAE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.107
country_id: 3469034
description:
Nov 26 19:51:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=168.0.224.107, lip=66.85.158.91, TLS, session=<ErnVG4BEboSoAOBr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 19:56:20 host2 sshd[4052859]: Disconnected from invalid user admin 2.57.121.112 port 28407 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 26 19:58:23 host2 sshd[4053994]: Disconnected from invalid user suporte 134.122.121.56 port 35796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov 26 19:59:35 host2 sshd[4054833]: Disconnected from invalid user roott 103.23.199.128 port 49196 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 26 19:59:50 host2 pure-ftpd[4055023]: (?@194.164.107.5) [INFO] New connection from 194.164.107.5


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 26 19:59:58 host2 sshd[4055068]: Disconnected from invalid user qwerty 45.172.152.74 port 48250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Nov 26 20:01:23 host2 sshd[4056341]: Disconnected from invalid user tuan 177.54.62.66 port 62809 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 26 20:02:54 host2 sshd[4057389]: Disconnected from invalid user intel 45.172.152.74 port 48202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Nov 26 20:03:45 host2 sshd[4058776]: Disconnected from invalid user qwerty 177.54.62.66 port 52495 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 26 20:04:14 host2 sshd[4059134]: Disconnected from invalid user builder 45.172.152.74 port 44782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov 26 20:04:18 host2 sshd[4059179]: Disconnected from invalid user fan 103.23.199.128 port 35360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.161
country_id: 732800
description:
Nov 26 20:05:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=185.255.212.161, lip=66.85.158.91, TLS, session=<A7rHTYBEptq5/9Sh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 26 20:05:34 host2 sshd[4060103]: Disconnected from invalid user test 172.245.168.112 port 34084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.118.132
country_id: 3469034
description:
Nov 26 20:05:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.87.118.132, lip=66.85.158.91, TLS, session=<jiP7ToBEC72xV3aE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Nov 26 20:05:17 host2 sshd[4059925]: Disconnected from invalid user abhi 177.54.62.66 port 54589 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 26 20:06:40 host2 sshd[4060650]: Disconnected from invalid user dev 45.172.152.74 port 45244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Nov 26 20:06:47 host2 sshd[4060736]: Disconnected from invalid user dev 177.54.62.66 port 58046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov 26 20:08:05 host2 sshd[4061383]: Disconnected from invalid user ts1 103.23.199.128 port 57284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.168.112
country_id: 6252001
description:
Nov 26 20:07:45 host2 sshd[4061195]: Disconnected from invalid user dev 172.245.168.112 port 38716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 26 20:07:52 host2 sshd[4061253]: Disconnected from invalid user david 45.172.152.74 port 52166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.103
country_id: 1269750
description:
Nov 26 20:09:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.70.126.103, lip=66.85.158.91, TLS, session=<YKFQWoBE9ZRnRn5n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Nov 26 20:08:17 host2 sshd[4061487]: Disconnected from invalid user localhost 177.54.62.66 port 65331 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.140.251
country_id: 3469034
description:
Nov 26 20:09:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=167.249.140.251, lip=66.85.158.91, TLS, session=<QFLDW4BEcqin+Yz7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.184
country_id: 953987
description:
Nov 26 20:11:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.45.184, lip=66.85.158.91, TLS, session=<6y92YYBEXtZmQC24>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov 26 20:11:29 host2 sshd[4063676]: Disconnected from invalid user admin123 103.23.199.128 port 49556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.107
country_id: 3469034
description:
Nov 26 20:11:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.209.250.107, lip=66.85.158.91, TLS, session=<pkq1YoBEcNO60fpr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 26 20:13:11 host2 sshd[4064748]: Disconnected from invalid user scan 134.122.121.56 port 48288 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Nov 26 20:15:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.91, session=<FxRdcoBEjqC4aff8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-26 20:15:28 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:60993: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-26 20:15:19 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40270: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 26 20:18:44 host2 sshd[4068539]: Disconnected from invalid user jenkins 134.122.121.56 port 54426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.202.169
country_id: 2635167
description:
Nov 26 20:21:09 host2 sshd[4070644]: Disconnected from invalid user newuser 167.99.202.169 port 47928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-26 20:21:47 dovecot_plain authenticator failed for (serrism) [24.104.225.201]:34978: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-11-26 20:21:51 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:54413: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-26 20:22:05 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:44198: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.23.191.87
country_id: 3469034
description:
Nov 26 20:27:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.23.191.87, lip=66.85.158.91, TLS, session=<yRfynYBE+uqxF79X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.243
country_id: 953987
description:
Nov 26 20:27:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.40.243, lip=66.85.158.91, TLS, session=<wnivnIBEzt1mQCjz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.207.75.24
country_id: 1522867
description:
Nov 26 20:28:20 host2 sshd[4076027]: Disconnected from invalid user userb 91.207.75.24 port 51650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.202.169
country_id: 2635167
description:
Nov 26 20:28:43 host2 sshd[4076271]: Disconnected from invalid user qwerty 167.99.202.169 port 52452 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.207.75.24
country_id: 1522867
description:
Nov 26 20:29:38 host2 sshd[4076915]: Disconnected from invalid user smart 91.207.75.24 port 46178 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.36
country_id: 3469034
description:
Nov 26 20:30:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=186.209.247.36, lip=66.85.158.91, TLS, session=<uV3WpYBEati60fck>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.204
country_id: 3175395
description:
Nov 26 20:30:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2>, method=PLAIN, rip=194.60.212.204, lip=66.85.158.91, TLS, session=<9fcWp4BEBeLCPNTM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.207.75.24
country_id: 1522867
description:
Nov 26 20:30:54 host2 sshd[4077916]: Disconnected from invalid user devuser 91.207.75.24 port 41430 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.18
country_id: 2510769
description:
Nov 26 20:31:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=185.74.243.18, lip=66.85.158.91, TLS, session=<z9pVqYBEAMG5SvMS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.152
country_id: 690791
description:
Nov 26 20:31:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=185.17.125.152, lip=66.85.158.91, TLS, session=<6JFqqoBEZbW5EX2Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov 26 20:31:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tlr2q4BEEodAPpxC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 20:32:42 host2 sshd[4079184]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.25.56
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.254.25.56 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.78
country_id: 1880251
description:
Nov 26 20:35:06 host2 sshd[4081062]: Disconnected from invalid user myuser 45.78.207.78 port 50136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.207.75.24
country_id: 1522867
description:
Nov 26 20:37:12 host2 sshd[4082479]: Disconnected from invalid user deploy 91.207.75.24 port 40814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-26 20:39:08 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (chear) [68.46.148.180]:53632: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.170.22.62
country_id: 6252001
description:
Nov 26 20:45:44 host2 pure-ftpd[4089093]: (?@107.170.22.62) [INFO] New connection from 107.170.22.62


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.78
country_id: 1880251
description:
Nov 26 20:49:23 host2 sshd[4091700]: Disconnected from invalid user grid 45.78.207.78 port 41812 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.170.22.62
country_id: 6252001
description:
Nov 26 20:50:16 host2 pure-ftpd[4092579]: (?@107.170.22.62) [INFO] New connection from 107.170.22.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.221.176
country_id: 1880251
description:
[2025-11-26 20:53:16 +0530] info [cpaneld] 152.42.221.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Nov 26 20:53:22 host2 sshd[4095517]: Disconnected from invalid user temp 94.182.15.94 port 45494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Nov 26 20:54:40 host2 sshd[4097432]: Disconnected from invalid user ctf 94.182.15.94 port 38970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.15.94
country_id: 130758
description:
Nov 26 20:57:06 host2 sshd[4100059]: Disconnected from invalid user node 94.182.15.94 port 49930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-26 20:57:23 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:44205: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Nov 26 20:58:19 host2 sshd[4101071]: Disconnected from invalid user vtatis 94.182.15.94 port 36420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov 26 20:58:33 host2 sshd[4101224]: Disconnected from invalid user ntps 103.165.156.59 port 36376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.15.94
country_id: 130758
description:
Nov 26 20:59:34 host2 sshd[4101862]: Disconnected from invalid user qiyuesuo 94.182.15.94 port 57202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-26 21:00:36 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (wisms) [73.145.107.251]:53040: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.8.120.90
country_id: 3469034
description:
Nov 26 21:02:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.8.120.90, lip=66.85.158.91, TLS, session=<O9vzF4FEXIO7CHha>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-26 21:02:04 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:53094: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-11-26 21:01:49 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:45905: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.149.93
country_id: 99237
description:
Nov 26 21:02:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=65.20.149.93, lip=66.85.158.91, TLS, session=<B/k/GYFEeppBFJVd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov 26 21:03:20 host2 sshd[4105158]: Disconnected from invalid user controlm 103.165.156.59 port 41754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.50
country_id: 6252001
description:
Nov 26 21:03:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.50, lip=66.85.158.92, session=<0NaWHoFEWxtAPsUy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.78
country_id: 1880251
description:
Nov 26 21:03:36 host2 sshd[4105320]: Disconnected from invalid user user 45.78.207.78 port 48568 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Nov 26 21:03:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.92, TLS: Connection closed, session=<h5ZdH4FEAvNAPsUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.165.156.59
country_id: 1643084
description:
Nov 26 21:04:44 host2 sshd[4106039]: Disconnected from invalid user tuan 103.165.156.59 port 44166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 21:07:52 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51672: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov 26 21:11:25 host2 sshd[4110585]: Disconnected from invalid user userb 103.165.156.59 port 44044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.156.59
country_id: 1643084
description:
Nov 26 21:12:45 host2 sshd[4111206]: Disconnected from invalid user 1 103.165.156.59 port 54450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 21:12:58 host2 sshd[4111280]: Disconnected from invalid user kenia 62.60.131.157 port 10398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 21:15:49 host2 sshd[4112975]: Disconnected from invalid user  2.57.121.112 port 61813 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Nov 26 21:18:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hGWcVYFEWBdAPpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Nov 26 21:19:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<luqxVoFECEJAPpzU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.199
country_id: 6252001
description:
Nov 26 21:21:27 host2 pure-ftpd[4116040]: (?@198.235.24.199) [INFO] New connection from 198.235.24.199


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.60
country_id: 798544
description:
Nov 26 21:22:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=128.127.94.60, lip=66.85.158.91, TLS, session=<8YjIYoFEIaSAf148>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.223
country_id: 3469034
description:
Nov 26 21:23:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.223, lip=66.85.158.91, TLS, session=<yHfuY4FEXuGxLGDf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-11-26 21:33:55 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:56976: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Nov 26 21:34:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, session=<hkjei4FEwPa4affC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 21:34:59 host2 sshd[4123962]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Nov 26 21:34:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS: Connection closed, session=<xmybjIFEApi4affC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-26 21:34:27 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:41055: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-26 21:35:38 dovecot_plain authenticator failed for (woodin) [5.32.61.6]:55613: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 21:41:07 host2 sshd[4127978]: Disconnected from invalid user admin 2.57.121.112 port 5578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-26 21:48:22 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:60130: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-26 21:48:50 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:52524: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.59
country_id: 130758
description:
2025-11-26 21:48:50 dovecot_login authenticator failed for (62.60.135.59) [62.60.135.59]:65003: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.211.186
country_id: 2921044
description:
Nov 26 21:51:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.211.186, lip=66.85.158.91, session=<WCTOyYFEz5XRJtO6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.44.176
country_id: 2921044
description:
Nov 26 21:51:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.44.176, lip=66.85.158.91, session=<qGncyYFEltNo+Cyw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.164
country_id: 6251999
description:
2025-11-26 22:00:49 dovecot_plain authenticator failed for ([10.2.18.231]) [91.193.6.164]:51184: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2025-11-26 22:10:16 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:53892: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.62
country_id: 1269750
description:
2025-11-26 22:10:28 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:54872: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Nov 26 22:11:02 host2 pure-ftpd[4163131]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 26 22:13:23 host2 sshd[4165406]: Disconnected from invalid user user2 161.132.50.86 port 36672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 26 22:14:13 host2 sshd[4165933]: Disconnected from invalid user odoo17 64.226.96.54 port 57752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 26 22:16:50 host2 sshd[4167847]: Disconnected from invalid user posiflex 161.132.50.86 port 49726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 26 22:17:18 host2 sshd[4168158]: Disconnected from invalid user userm 64.226.96.54 port 58682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 26 22:18:03 host2 sshd[4168652]: Disconnected from invalid user max 161.132.50.86 port 47052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 26 22:18:18 host2 sshd[4168815]: Disconnected from invalid user gerrit 64.226.96.54 port 49188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 26 22:19:15 host2 sshd[4169635]: Disconnected from invalid user mike 161.132.50.86 port 40670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 22:19:59 host2 sshd[4170181]: Disconnected from invalid user manager 2.57.121.112 port 62889 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-26 22:21:03 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:45632: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-26 22:21:20 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:52248: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 26 22:21:52 host2 sshd[4171721]: Disconnected from invalid user elk 203.150.107.244 port 45384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-26 22:22:57 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:54870: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-26 22:23:09 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:48740: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-26 22:23:08 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:59396: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.218.248.208
country_id: 6252001
description:
Nov 26 22:22:26 host2 pure-ftpd[4172274]: (?@13.218.248.208) [INFO] New connection from 13.218.248.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-26 22:23:46 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:51488: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov 26 22:24:55 host2 sshd[4174333]: Disconnected from invalid user ftptest 138.99.80.102 port 36030 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 22:25:49 host2 sshd[4175128]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov 26 22:25:14 host2 sshd[4174667]: Disconnected from invalid user vagrant 161.132.68.222 port 53788 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.234
country_id: 6252001
description:
Nov 26 22:25:20 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.91, TLS, session=<m7cAQ4JECOBHBobq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 26 22:25:42 host2 sshd[4175023]: Disconnected from invalid user desliga 203.150.107.244 port 42206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 26 22:27:04 host2 sshd[4175931]: Disconnected from invalid user jeremy 203.150.107.244 port 41066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 26 22:28:27 host2 sshd[4176892]: Disconnected from invalid user nagios 203.150.107.244 port 39934 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 22:28:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<I4yuTYJEvIYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov 26 22:33:10 host2 sshd[4180384]: Disconnected from invalid user manager 161.132.68.222 port 50668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Nov 26 22:33:13 host2 sshd[4180439]: Disconnected from invalid user user01 138.99.80.102 port 60940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-11-26 22:34:21 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:54502: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 26 22:34:51 host2 sshd[4181542]: Disconnected from invalid user factorio 203.150.107.244 port 34278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-11-26 22:35:05 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:61034: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov 26 22:35:48 host2 sshd[4182655]: Disconnected from invalid user ivan 138.99.80.102 port 54604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov 26 22:36:09 host2 sshd[4182931]: Disconnected from invalid user laravel 161.132.68.222 port 45418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 26 22:37:27 host2 sshd[4183825]: Disconnected from invalid user lucas 103.86.180.10 port 46893 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov 26 22:37:37 host2 sshd[4183955]: Disconnected from invalid user casaos 161.132.68.222 port 60420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.231
country_id: 2635167
description:
Nov 26 22:39:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.231, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<t5andoJErNYjy9Pn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.231
country_id: 2635167
description:
Nov 26 22:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.211.231, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<U39meIJE3vIjy9Pn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 26 22:40:31 host2 sshd[4186620]: Disconnected from invalid user samba 155.4.244.169 port 58001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Nov 26 22:41:57 host2 sshd[4187794]: Disconnected from invalid user hdfs 182.253.79.194 port 4083 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Nov 26 22:42:46 host2 sshd[4188456]: Disconnected from invalid user root2 124.155.125.131 port 52258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Nov 26 22:43:21 host2 sshd[4188926]: Disconnected from invalid user training 182.253.79.194 port 4341 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 26 22:44:05 host2 sshd[4189450]: Disconnected from invalid user abc 155.4.244.169 port 30032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-26 22:45:49 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:49364: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.79.194
country_id: 1643084
description:
Nov 26 22:46:01 host2 sshd[4191625]: Disconnected from invalid user ntps 182.253.79.194 port 13936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-26 22:45:26 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:57852: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.231
country_id: 2635167
description:
Nov 26 22:46:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.231, lip=66.85.158.91, TLS, session=<OCTdj4JE5vojy9Pn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Nov 26 22:47:23 host2 sshd[4192611]: Disconnected from invalid user wordpress 182.253.79.194 port 27343 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 26 22:49:12 host2 sshd[4193748]: Disconnected from invalid user training 103.86.180.10 port 45539 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.102.191
country_id: 6252001
description:
Nov 26 22:50:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.102.191, lip=66.85.158.91, session=</zeym4JESNstT2a/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 22:51:05 host2 sshd[1364]: Disconnected from invalid user maiya 62.60.131.157 port 42674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Nov 26 22:52:34 host2 sshd[2427]: Disconnected from invalid user ivan 182.253.79.194 port 20222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Nov 26 22:52:36 host2 sshd[2459]: Disconnected from invalid user ansadmin 124.155.125.131 port 33862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Nov 26 22:52:55 host2 sshd[2640]: Disconnected from invalid user ivan 103.86.180.10 port 58281 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 26 22:53:10 host2 sshd[2847]: Disconnected from invalid user ivan 155.4.244.169 port 13419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Nov 26 22:53:51 host2 sshd[3218]: Disconnected from invalid user bkp 124.155.125.131 port 33648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.184.248
country_id: 2921044
description:
Nov 26 22:54:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.184.248, lip=66.85.158.91, session=<Cr9drIJEjpouZbj4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 26 22:54:34 host2 sshd[4289]: Disconnected from invalid user t3rr0r 155.4.244.169 port 47892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.155.186
country_id: 2921044
description:
Nov 26 22:54:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.155.186, lip=66.85.158.91, session=<X2xYrIJEmUsuZZu6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-11-26 22:59:24 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:40003: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-26 22:59:52 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:43796: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-26 23:03:50 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:56168: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.153
country_id: 6252001
description:
Nov 26 23:03:47 host2 pure-ftpd[10150]: (?@198.235.24.153) [INFO] New connection from 198.235.24.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-26 23:04:11 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:51334: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.131
country_id: 6252001
description:
Nov 26 23:04:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.131, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<g/F/0IJE7tSTuYWD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.131
country_id: 6252001
description:
Nov 26 23:05:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.131, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vu3O0oJE+v6TuYWD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.56.170
country_id: 6252001
description:
Nov 26 23:08:53 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.153.56.170, lip=66.85.158.91, session=</qa+3oJECNqUmTiq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.131
country_id: 6252001
description:
Nov 26 23:12:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.131, lip=66.85.158.92, TLS, session=<6grD7IJEyPiTuYWD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.131
country_id: 6252001
description:
Nov 26 23:13:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.131, lip=66.85.158.92, TLS, session=<0l+E74JE0OiTuYWD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-26 23:15:14 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:59492: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.124
country_id: 294640
description:
2025-11-26 23:15:46 dovecot_login authenticator failed for ([2.55.70.124]) [2.55.70.124]:38070: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.33.27
country_id: 1168579
description:
2025-11-26 23:17:09 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [59.103.33.27]:63274: 535 Incorrect authentication data (set_id=accounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.33.27
country_id: 1168579
description:
2025-11-26 23:17:16 dovecot_login authenticator failed for (I7QG1XB55L1Y) [59.103.33.27]:63274: 535 Incorrect authentication data (set_id=accounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.67.250
country_id: 3469034
description:
2025-11-26 23:22:10 dovecot_login authenticator failed for (189-108-162-95.customer.tdatabrasil.net.br) [201.63.67.250]:36846: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-26 23:22:22 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:55666: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 23:26:36 host2 sshd[26589]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-26 23:31:11 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:55850: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.193.134
country_id: 1269750
description:
2025-11-26 23:31:22 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:51838: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.134.212.78
country_id: 798544
description:
2025-11-26 23:31:39 dovecot_plain authenticator failed for ([192.168.1.2]) [45.134.212.78]:64018: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov 26 23:37:54 host2 sshd[35850]: Disconnected from invalid user socks 185.193.240.246 port 58292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov 26 23:41:54 host2 sshd[39432]: Disconnected from invalid user pivpn 185.193.240.246 port 60584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 23:42:36 host2 sshd[39929]: Disconnected from invalid user melisa 62.60.131.157 port 7724 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.193.240.246
country_id: 718075
description:
Nov 26 23:43:13 host2 sshd[40431]: Disconnected from invalid user tony 185.193.240.246 port 59316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 23:44:17 host2 sshd[41489]: Disconnected from invalid user admin 2.57.121.112 port 40889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov 26 23:44:24 host2 sshd[41651]: Disconnected from invalid user dixi 185.193.240.246 port 58020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 26 23:45:05 host2 sshd[42650]: Disconnected from invalid user jrodrig 155.4.244.107 port 9977 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 26 23:47:47 host2 sshd[44793]: Disconnected from invalid user user2 155.4.244.107 port 25699 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-11-26 23:47:51 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:50016: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2025-11-26 23:48:04 dovecot_login authenticator failed for (177-174-89-105.user.vivozap.com.br) [177.174.89.99]:47787: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 26 23:53:09 host2 sshd[49340]: Disconnected from invalid user hu 155.4.244.107 port 5008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 26 23:52:24 host2 sshd[48851]: Disconnected from invalid user admin 152.32.172.161 port 35650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-11-26 23:55:58 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:36534: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Nov 26 23:56:24 host2 sshd[52663]: Disconnected from invalid user gg 85.18.236.229 port 51564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.124.17
country_id: 1512440
description:
2025-11-26 23:56:48 dovecot_login authenticator failed for (17.64.uzpak.uz) [213.230.124.17]:58074: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Nov 26 23:58:37 host2 sshd[54094]: Disconnected from invalid user int 85.18.236.229 port 48966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 26 23:59:14 host2 sshd[54529]: Disconnected from invalid user jacob 152.32.172.161 port 36188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Nov 26 23:59:38 host2 sshd[54858]: Disconnected from invalid user teamspeak 85.18.236.229 port 47660 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 27 00:01:44 host2 sshd[56982]: Disconnected from invalid user int 152.32.172.161 port 47028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-27 00:03:44 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:51300: 535 Incorrect authentication data (set_id=consultas@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-27 00:03:58 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:38938: 535 Incorrect authentication data (set_id=consultas)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 00:05:44 host2 sshd[60517]: Disconnected from invalid user melisa 62.60.131.157 port 28577 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 27 00:06:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS: Connection closed, session=<bl9OrYNE3h9ChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.125
country_id: 3508796
description:
2025-11-27 00:06:44 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.125]:49970: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-27 00:06:59 dovecot_login authenticator failed for ([122.187.221.130]) [122.187.221.130]:33140: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 27 00:07:27 host2 sshd[61613]: Disconnected from invalid user radio 152.32.172.161 port 40588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 27 00:09:00 host2 sshd[62720]: Disconnected from invalid user root123 152.32.172.161 port 41354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 00:08:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<WchZtINEmuUXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 27 00:10:32 host2 sshd[64129]: Disconnected from invalid user teamspeak 152.32.172.161 port 54246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.26.164
country_id: 294640
description:
2025-11-27 00:11:35 dovecot_login authenticator failed for ([95.35.26.164]) [95.35.26.164]:55708: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-11-27 00:11:53 dovecot_login authenticator failed for (nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:52658: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.229
country_id: 1733045
description:
2025-11-27 00:12:16 dovecot_login authenticator failed for ([49.124.152.229]) [49.124.152.229]:44860: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 00:14:53 host2 sshd[67454]: Disconnected from invalid user admin 2.57.121.112 port 32879 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 00:17:19 host2 sshd[69839]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-11-27 00:27:37 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:53124: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-27 00:27:46 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:35394: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.146
country_id: 6252001
description:
Nov 27 00:31:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.146, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xaXLBIREPJoUQGmS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.116.208.101
country_id: 6252001
description:
2025-11-27 00:30:18 dovecot_login authenticator failed for 24-116-208-101.cpe.sparklight.net [24.116.208.101]:37829: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-27 00:30:32 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:52089: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.203.233
country_id: 6251999
description:
Nov 27 00:31:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.203.233, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<T9NYB4REVpCAy8vp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.186.101
country_id: 6252001
description:
Nov 27 00:32:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.186.101, lip=66.85.158.91, session=<qVnbCIREJssofLpl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.196.4
country_id: 6252001
description:
Nov 27 00:36:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.106.196.4, lip=66.85.158.92, session=<r3xSF4REcpgUasQE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-27 00:40:09 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:48224: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-27 00:40:25 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:37801: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-11-27 00:40:42 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:58386: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-27 00:40:43 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:38501: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.238.91
country_id: 6252001
description:
Nov 27 00:41:39 host2 pure-ftpd[88886]: (?@165.154.238.91) [INFO] New connection from 165.154.238.91


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.210.68.2
country_id: 6252001
description:
Nov 27 00:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.210.68.2, lip=66.85.158.91, session=<1gljMIRE+oCs0kQC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.238.91
country_id: 6252001
description:
Nov 27 00:46:06 host2 pure-ftpd[92683]: (?@165.154.238.91) [INFO] New connection from 165.154.238.91


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 00:46:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<T0lDPYRE3poXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 00:47:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<K+QdPoREDOsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-27 00:47:55 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:49732: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-27 00:48:24 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:48511: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.207
country_id: 6252001
description:
Nov 27 00:49:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.192.207, lip=66.85.158.92, session=<Cw7fRoRE8ucUQcDP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 00:57:44 host2 sshd[101697]: Disconnected from invalid user usuario 2.57.121.112 port 61833 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Nov 27 00:57:58 host2 sshd[101813]: Disconnecting authenticating user root 176.235.182.73 port 37986: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Nov 27 00:57:58 host2 sshd[101813]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 37986 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.182.73
country_id: 298795
description:
Nov 27 00:58:10 host2 sshd[101973]: error: maximum authentication attempts exceeded for invalid user admin from 176.235.182.73 port 40843 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.241.36.24 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Nov 27 00:58:13 host2 sshd[101994]: Disconnecting invalid user admin 176.235.182.73 port 41611: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.239.141
country_id: 2921044
description:
Nov 27 00:58:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=165.154.239.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZRhUZoREkIulmu+N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-27 00:59:40 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:33766: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-27 00:59:49 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:37619: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.239.141
country_id: 2921044
description:
Nov 27 01:01:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.239.141, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8pyQcYREBuulmu+N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-27 01:04:22 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:50526: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-27 01:04:50 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:41885: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 01:05:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59561: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.201.155
country_id: 6251999
description:
Nov 27 01:06:17 host2 pure-ftpd[109239]: (?@128.203.201.155) [INFO] New connection from 128.203.201.155


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 01:10:49 host2 sshd[112486]: Disconnected from invalid user admin 2.57.121.112 port 13001 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-27 01:11:49 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (hipect) [73.88.196.91]:46012: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-11-27 01:15:23 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:42456: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-11-27 01:15:57 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:51078: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 01:17:58 host2 sshd[117608]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 60.48.255.61
country_id: 1733045
description:
Nov 27 01:21:16 host2 sshd[119946]: error: maximum authentication attempts exceeded for root from 60.48.255.61 port 52673 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 60.48.255.61
country_id: 1733045
description:
Nov 27 01:21:16 host2 sshd[119946]: Disconnecting authenticating user root 60.48.255.61 port 52673: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.253
country_id: 1733045
description:
2025-11-27 01:22:07 dovecot_login authenticator failed for ([49.124.150.253]) [49.124.150.253]:56552: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-11-27 01:21:56 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:52396: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-11-27 01:22:57 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:33442: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-27 01:22:41 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:37524: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Nov 27 01:28:14 host2 sshd[124868]: Disconnected from invalid user share 101.47.143.72 port 53038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Nov 27 01:32:41 host2 sshd[127561]: Disconnected from invalid user userb 101.47.143.72 port 33926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Nov 27 01:33:58 host2 sshd[128374]: Disconnected from invalid user crafty 208.69.84.112 port 34134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.72
country_id: 1880251
description:
Nov 27 01:35:10 host2 sshd[129234]: Disconnected from invalid user radio 101.47.143.72 port 52894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Nov 27 01:37:05 host2 sshd[130354]: Disconnected from invalid user ftptest 208.69.84.112 port 36298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2025-11-27 01:39:26 dovecot_login authenticator failed for ([49.124.149.204]) [49.124.149.204]:46866: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 27 01:39:43 host2 sshd[131740]: Disconnected from invalid user userb 167.99.78.165 port 49430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-27 01:39:55 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:54023: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 01:39:59 host2 sshd[131983]: Disconnected from invalid user admin 2.57.121.112 port 13232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 208.69.84.112
country_id: 6252001
description:
Nov 27 01:40:30 host2 sshd[132425]: Disconnected from invalid user userb 208.69.84.112 port 42740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Nov 27 01:41:33 host2 sshd[133281]: Disconnected from invalid user odoo17 208.69.84.112 port 52010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 27 01:43:25 host2 sshd[134730]: Disconnected from invalid user bitwarden 167.99.78.165 port 50918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 27 01:44:39 host2 sshd[135877]: Disconnected from invalid user autrede 167.99.78.165 port 49060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 27 01:45:55 host2 sshd[136793]: Disconnected from invalid user odoo15 167.99.78.165 port 46958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov 27 01:46:43 host2 sshd[137201]: Disconnected from invalid user devuser 162.240.156.34 port 41564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.19
country_id: 1880251
description:
Nov 27 01:46:59 host2 sshd[137318]: Disconnected from invalid user local 45.78.224.19 port 56998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov 27 01:47:53 host2 sshd[137818]: Disconnected from invalid user root2 162.240.156.34 port 40230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Nov 27 01:48:56 host2 sshd[138323]: Disconnected from invalid user jrodrig 162.240.156.34 port 38886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Nov 27 01:49:44 host2 sshd[138687]: Disconnected from invalid user huawei 101.47.143.72 port 41482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 27 01:51:08 host2 sshd[139730]: Disconnected from invalid user copia 50.232.189.209 port 35900 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.249
country_id: 1733045
description:
2025-11-27 01:51:25 dovecot_login authenticator failed for ([49.124.150.249]) [49.124.150.249]:42198: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-11-27 01:51:50 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:32876: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.72
country_id: 1880251
description:
Nov 27 01:52:10 host2 sshd[140188]: Disconnected from invalid user msf 101.47.143.72 port 33704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-27 01:55:17 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:48638: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-27 01:55:35 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:52554: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-27 01:55:53 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:51882: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-27 01:55:59 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:39199: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 27 01:56:09 host2 sshd[143662]: Disconnected from invalid user ventas01 50.232.189.209 port 59020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.191
country_id: 6252001
description:
Nov 27 01:56:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=48.214.144.191, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<WF/HNoVEDrIw1pC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 27 01:57:01 host2 sshd[144036]: Disconnected from invalid user sales1 81.192.46.45 port 53502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 27 01:57:26 host2 sshd[144242]: Disconnected from invalid user devuser 50.232.189.209 port 57736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 27 01:58:29 host2 sshd[144772]: Disconnected from invalid user ahmed 198.98.57.141 port 34278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 27 02:00:06 host2 sshd[145518]: Disconnected from invalid user guest123 45.78.204.222 port 34686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.83
country_id: 6252001
description:
Nov 27 02:01:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.83, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q84ISIVE4drG6xhT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 27 02:01:04 host2 sshd[146417]: Disconnected from invalid user huawei 198.98.57.141 port 48480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Nov 27 02:01:09 host2 sshd[146457]: Disconnected from invalid user gerrit 94.102.4.12 port 59296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 27 02:01:33 host2 sshd[146705]: Disconnected from invalid user ahmed 118.139.164.171 port 54640 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.45
country_id: 2542007
description:
Nov 27 02:01:46 host2 sshd[146878]: Disconnected from invalid user support 81.192.46.45 port 42576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.79
country_id: 6252001
description:
Nov 27 02:01:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=48.214.144.79, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<o+YvSYVEtK0w1pBP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.19
country_id: 1880251
description:
Nov 27 02:02:40 host2 sshd[147399]: Disconnected from invalid user jmarquez 45.78.224.19 port 49698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 27 02:04:19 host2 sshd[148826]: Disconnected from invalid user root123 45.78.204.222 port 54058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Nov 27 02:04:45 host2 sshd[149160]: Disconnected from invalid user gits 94.102.4.12 port 55618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 27 02:05:34 host2 sshd[149844]: Disconnected from invalid user vendas 118.139.164.171 port 47396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.35.246.255
country_id: 357994
description:
2025-11-27 02:06:56 dovecot_plain authenticator failed for (U289EEWT) [41.35.246.255]:9808: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 27 02:07:14 host2 sshd[151079]: Disconnected from invalid user newuser 152.200.205.179 port 58816 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.203
country_id: 6252001
description:
Nov 27 02:07:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.203, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fur8XIVEacDN0h/L>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 27 02:06:47 host2 sshd[150604]: Disconnected from invalid user testftp 118.139.164.171 port 37678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 27 02:06:55 host2 sshd[150773]: Disconnected from invalid user gits 198.98.57.141 port 42924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-27 02:08:15 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:10125: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-27 02:07:50 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:62140: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 02:08:34 host2 sshd[152132]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 27 02:09:05 host2 sshd[152560]: Disconnected from invalid user ftpuser 198.98.57.141 port 40694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 27 02:10:02 host2 sshd[153424]: Disconnected from invalid user gits 152.200.205.179 port 39818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 27 02:11:33 host2 sshd[154564]: Disconnected from invalid user huawei 152.200.205.179 port 39736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Nov 27 02:12:34 host2 sshd[155261]: Disconnected from invalid user aaa 94.102.4.12 port 47002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2025-11-27 02:12:36 dovecot_login authenticator failed for ([149.54.51.230]) [149.54.51.230]:53577: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-27 02:12:55 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:52139: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.222
country_id: 1880251
description:
Nov 27 02:17:20 host2 sshd[158795]: Disconnected from invalid user elemental 45.78.204.222 port 39700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Nov 27 02:18:38 host2 sshd[159655]: Disconnected from invalid user blue 125.20.16.22 port 17672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.178
country_id: 3686110
description:
Nov 27 02:20:52 host2 sshd[161243]: Disconnected from invalid user sahil 152.200.205.178 port 39364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.234.36
country_id: 2328926
description:
Nov 27 02:22:25 host2 sshd[162213]: Disconnected from invalid user radio 165.154.234.36 port 40168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 27 02:21:59 host2 sshd[161909]: Disconnected from invalid user bodega 172.208.24.217 port 62028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.178
country_id: 3686110
description:
Nov 27 02:23:31 host2 sshd[162903]: Disconnected from invalid user support 152.200.205.178 port 48064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Nov 27 02:23:45 host2 sshd[163041]: Disconnected from invalid user server 125.20.16.22 port 31174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.234.36
country_id: 2328926
description:
Nov 27 02:24:35 host2 sshd[163741]: Disconnected from invalid user javad 165.154.234.36 port 42868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.178
country_id: 3686110
description:
Nov 27 02:26:23 host2 sshd[165410]: Disconnected from invalid user newuser 152.200.205.178 port 38792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 27 02:26:55 host2 sshd[165778]: Disconnected from invalid user share 172.208.24.217 port 13770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.83.184
country_id: 1605651
description:
Nov 27 02:27:30 host2 sshd[166087]: Disconnected from invalid user blue 203.154.83.184 port 32996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.233.65
country_id: 6252001
description:
Nov 27 02:27:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.236.233.65, lip=66.85.158.91, session=<EPdPpYVEUuCs7OlB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Nov 27 02:27:45 host2 sshd[166265]: Disconnected from invalid user debian 125.20.16.22 port 45462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.178
country_id: 3686110
description:
Nov 27 02:29:20 host2 sshd[167266]: Disconnected from invalid user server 152.200.205.178 port 51546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 27 02:29:28 host2 sshd[167330]: Disconnected from invalid user ubuntu 172.208.24.217 port 21130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.83.184
country_id: 1605651
description:
Nov 27 02:30:16 host2 sshd[168058]: Disconnected from invalid user postgres 203.154.83.184 port 32834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-27 02:30:43 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:52512: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 27 02:30:45 host2 sshd[168335]: Disconnected from invalid user guest123 172.208.24.217 port 23714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-27 02:30:34 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:44046: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.154.83.184
country_id: 1605651
description:
Nov 27 02:31:45 host2 sshd[168983]: Disconnected from invalid user ubuntu 203.154.83.184 port 39752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 02:33:32 host2 sshd[170106]: Disconnected from invalid user admin 2.57.121.112 port 44885 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Nov 27 02:33:13 host2 sshd[169939]: Disconnected from invalid user server 172.208.24.217 port 27968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.43.29.16
country_id: 1861060
description:
Nov 27 02:33:29 host2 sshd[170079]: Disconnected from invalid user ts1 162.43.29.16 port 51438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-27 02:38:12 dovecot_login authenticator failed for (ip63HX8C) [185.196.8.151]:53775: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.43.29.16
country_id: 1861060
description:
Nov 27 02:38:32 host2 sshd[174438]: Disconnected from invalid user dangulo 162.43.29.16 port 37864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-27 02:38:36 dovecot_login authenticator failed for (gt3bhKT) [185.196.8.151]:60279: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-27 02:40:08 dovecot_login authenticator failed for (wji8iFw2) [185.196.8.151]:50020: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-27 02:44:19 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (potonbulne) [37.150.8.174]:37230: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-27 02:44:22 dovecot_plain authenticator failed for (doutric) [88.149.153.106]:38670: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.254.128
country_id: 1522867
description:
2025-11-27 02:45:23 dovecot_login authenticator failed for 2.135.254.128.dynamic.telecom.kz [2.135.254.128]:60041: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 02:46:31 host2 sshd[180121]: Disconnected from invalid user  2.57.121.112 port 62417 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.165
country_id: 2186224
description:
2025-11-27 02:46:00 dovecot_login authenticator failed for ([121.73.169.165]) [121.73.169.165]:38480: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.219.157.156
country_id: 1880251
description:
Nov 27 02:48:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=8.219.157.156, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<61Xq7oVEiHkI252c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.237
country_id: 1880251
description:
Nov 27 02:47:31 host2 sshd[180751]: Disconnected from invalid user server 45.78.229.237 port 59300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.219.157.156
country_id: 1880251
description:
Nov 27 02:48:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=8.219.157.156, lip=66.85.158.91, TLS, session=<lNW28IVElnkI252c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.229.237
country_id: 1880251
description:
Nov 27 02:50:07 host2 sshd[182963]: Disconnected from invalid user bodega 45.78.229.237 port 38628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.237
country_id: 1880251
description:
Nov 27 02:52:39 host2 sshd[184918]: Disconnected from invalid user user1 45.78.229.237 port 41294 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.18
country_id: 6252001
description:
Nov 27 02:54:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=198.235.24.18, lip=66.85.158.92, session=<8j2PBIZEqPvG6xgS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 02:57:07 host2 sshd[188887]: Disconnected from invalid user zjw 43.134.25.150 port 46326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-11-27 02:58:03 dovecot_login authenticator failed for (76.73.197.124.unknown.m1.com.sg) [124.197.73.76]:32926: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 02:58:22 host2 sshd[189979]: Disconnected from invalid user python 43.134.25.150 port 44118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2025-11-27 02:58:25 dovecot_login authenticator failed for ([49.124.146.42]) [49.124.146.42]:58582: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-27 03:00:06 dovecot_plain authenticator failed for (exquate) [102.53.15.17]:53482: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-27 03:00:28 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:36633: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 02:59:35 host2 sshd[190761]: Disconnected from invalid user server 43.134.25.150 port 43770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:01:32 host2 sshd[192312]: Disconnected from invalid user admin 2.57.121.112 port 38638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-27 03:00:50 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:39504: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 03:02:09 host2 sshd[192834]: Disconnected from invalid user public 43.134.25.150 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-27 03:04:00 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:55642: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-11-27 03:04:24 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:34293: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-27 03:05:09 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:31591: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 03:08:56 host2 sshd[197572]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 03:14:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kj7OTYZEWpQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-11-27 03:16:37 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:53768: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-27 03:16:45 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:37509: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.66.124
country_id: 2921044
description:
Nov 27 03:17:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.226.66.124, lip=66.85.158.91, TLS, session=<pwG6WIZEthZA4kJ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-27 03:25:42 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:40542: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.124
country_id: 6252001
description:
Nov 27 03:28:18 host2 pure-ftpd[211722]: (?@195.184.76.124) [INFO] New connection from 195.184.76.124


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.127
country_id: 6252001
description:
Nov 27 03:28:17 host2 pure-ftpd[211715]: (?@195.184.76.127) [INFO] New connection from 195.184.76.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 03:31:17 host2 sshd[213937]: Disconnected from invalid user jorden 62.60.131.157 port 9632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-27 03:33:17 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:62664: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-27 03:33:40 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:36822: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-27 03:40:23 dovecot_login authenticator failed for ([127.0.0.1]) [213.55.85.202]:3532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-27 03:40:00 dovecot_login authenticator failed for ([127.0.0.1]) [49.249.76.221]:60334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-27 03:40:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:52396: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-27 03:41:01 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:58966: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 27 03:46:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<HUBhvoZEWIEiemm2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.251
country_id: 6252001
description:
Nov 27 03:46:25 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.251, lip=66.85.158.92, session=<UqM+v4ZE3JAtT7X7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:47:38 host2 sshd[226175]: Disconnected from invalid user  2.57.121.112 port 62363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-27 03:49:00 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40816: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-27 03:49:16 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:48328: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:54:27 host2 sshd[231584]: Disconnected from invalid user admin 2.57.121.112 port 5965 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-27 03:57:23 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:52122: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 03:59:40 host2 sshd[236681]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:02:18 host2 sshd[239116]: Disconnected from invalid user admin1 206.238.40.227 port 57038 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-27 04:04:57 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:50276: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:08:02 host2 sshd[245387]: Disconnected from invalid user precio01 206.238.40.227 port 49440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.115.112.108
country_id: 6252001
description:
2025-11-27 04:09:16 dovecot_login authenticator failed for 146-115-112-108.s362.c3-0.wak-ubr1.sbo-wak.ma.cable.rcncustomer.com [146.115.112.108]:40086: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:09:17 host2 sshd[246611]: Disconnected from invalid user fred 206.238.40.227 port 56324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-27 04:08:53 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:58702: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:10:23 host2 sshd[247742]: Disconnected from invalid user testuser 185.202.207.17 port 41922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:10:37 host2 sshd[247979]: Disconnected from invalid user tecnopos 206.238.40.227 port 43454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:11:58 host2 sshd[249064]: Disconnected from invalid user hello 185.202.207.17 port 44302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:15:46 host2 sshd[254149]: Disconnected from invalid user user10 185.202.207.17 port 34696 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 04:16:11 host2 sshd[254724]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-11-27 04:17:58 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:60673: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-27 04:17:37 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:47928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-27 04:19:07 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:60646: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-27 04:18:42 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:51338: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-27 04:18:53 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:45235: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 27 04:24:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.92, session=<WDf0RYdEDKNHBobo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.163.174
country_id: 6252001
description:
Nov 27 04:25:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.15.163.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8CLLSodE4KoUD6Ou>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-11-27 04:27:43 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:55464: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.113.228
country_id: 6252001
description:
Nov 27 04:32:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.113.228, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uFOxY4dEMLUUqHHk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-27 04:34:50 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:57192: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-27 04:35:05 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:37962: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 04:45:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ttRWk4dEutUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-27 04:46:01 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (gradity) [24.127.53.61]:55976: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-27 04:52:08 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:39600: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-27 04:52:14 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:42418: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-27 04:52:23 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:38826: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2025-11-27 04:52:39 dovecot_login authenticator failed for ([117.205.2.9]) [117.205.2.9]:37372: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 04:55:13 host2 sshd[293138]: Disconnected from invalid user kayden 62.60.131.157 port 26160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.183
country_id: 2017370
description:
2025-11-27 04:55:37 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:57540: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-11-27 04:55:58 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:42104: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 04:56:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55698: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 05:00:04 host2 sshd[297123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-27 05:01:38 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:48203: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-27 05:01:47 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:33862: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.183
country_id: 3017382
description:
Nov 27 05:08:08 host2 pure-ftpd[303841]: (?@91.196.152.183) [INFO] New connection from 91.196.152.183


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.208
country_id: 3017382
description:
Nov 27 05:08:09 host2 pure-ftpd[303850]: (?@91.196.152.208) [INFO] New connection from 91.196.152.208


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 05:14:04 host2 sshd[308977]: Disconnected from invalid user admin 2.57.121.112 port 39511 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-27 05:14:17 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (arapal) [174.59.253.88]:50868: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-27 05:15:02 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:49618: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.51.82
country_id: 1269750
description:
2025-11-27 05:15:04 dovecot_login authenticator failed for ([182.79.51.82]) [182.79.51.82]:38598: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-27 05:15:23 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:48583: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-27 05:14:57 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50620: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-27 05:15:34 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:53910: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-11-27 05:23:00 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:48712: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-27 05:22:49 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:50175: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 05:23:39 host2 sshd[316353]: Disconnected from invalid user kayden 62.60.131.157 port 17549 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-27 05:29:00 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:59367: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-11-27 05:30:18 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:62501: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-27 05:30:00 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:34442: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.192.138
country_id: 6252001
description:
Nov 27 05:30:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.192.138, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<BQevNIhE7oBC8MCK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.192.138
country_id: 6252001
description:
Nov 27 05:30:50 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=66.240.192.138, lip=66.85.158.92, TLS, session=<frqsNIhEiu1C8MCK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.46
country_id: 6252001
description:
Nov 27 05:33:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.46, lip=66.85.158.92, TLS, session=<Xm+fPohEtubN0h8u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 27 05:37:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<xXrrS4hEEpqLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-11-27 05:38:50 dovecot_login authenticator failed for ([200.195.67.82]) [200.195.67.82]:35042: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-11-27 05:39:04 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:39768: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-27 05:39:13 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:56010: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-11-27 05:40:39 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:43276: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 05:41:21 host2 sshd[329052]: Disconnected from invalid user admin 2.57.121.112 port 19170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-27 05:49:01 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:54202: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-27 05:49:17 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:33462: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 05:50:38 host2 sshd[336936]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.254
country_id: 6252001
description:
Nov 27 06:00:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.254, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9sKXnYhEC9bG6xj+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-27 06:03:07 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:56568: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-27 06:03:24 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:52402: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-27 06:09:53 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:57803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:09:55 host2 sshd[353171]: Disconnected from invalid user syncthing 103.171.85.117 port 54266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-27 06:09:46 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:38200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:16:47 host2 sshd[359925]: Disconnected from invalid user jmarquez 103.171.85.117 port 34156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:18:37 host2 sshd[361444]: Disconnected from invalid user ionadmin 103.171.85.117 port 50168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.0
country_id: 6252001
description:
Nov 27 06:18:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.251.92.0, lip=66.85.158.92, session=<kxh84IhEWMUv+1wA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-27 06:20:27 dovecot_login authenticator failed for ([127.0.0.1]) [27.123.111.110]:60656: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-11-27 06:20:39 dovecot_login authenticator failed for ([127.0.0.1]) [125.19.158.2]:50106: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-11-27 06:20:48 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:57386: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-27 06:20:17 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:47824: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:22:12 host2 sshd[364137]: Disconnected from invalid user user2 103.171.85.117 port 35406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-27 06:22:20 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:39163: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-11-27 06:22:26 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:47683: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-27 06:22:38 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38898: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-27 06:23:41 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:58551: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-11-27 06:23:50 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:60813: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:25:58 host2 sshd[366792]: Disconnected from invalid user vtatis 103.171.85.117 port 55716 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 06:27:12 host2 sshd[367705]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-27 06:28:04 dovecot_login authenticator failed for ([127.0.0.1]) [200.216.168.226]:42789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-27 06:28:12 dovecot_login authenticator failed for ([127.0.0.1]) [209.23.72.144]:59274: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 06:33:06 host2 sshd[371629]: Disconnected from invalid user admin 2.57.121.112 port 54292 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.17.192
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 105.112.17.192 - jagath.peiris@ajsstarlog.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.79
country_id: 6252001
description:
Nov 27 06:39:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.79, lip=66.85.158.91, TLS, session=<TOhXK4lEBOzG6xhP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 06:40:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<QNwvLolE/JiSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 06:44:52 host2 sshd[381587]: Disconnected from invalid user adrian 62.60.131.157 port 64955 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-11-27 06:45:14 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (exple) [50.74.136.134]:60848: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-11-27 06:49:04 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:37044: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-27 06:49:15 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:50581: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 06:51:16 host2 sshd[386879]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-27 06:51:35 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:50864: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-27 06:51:51 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:36496: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 07:00:07 host2 sshd[394323]: Disconnected from invalid user admin 2.57.121.112 port 48157 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-27 07:03:30 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:59158: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-27 07:03:44 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:51218: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 27 07:10:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xOYxmYlEu/7CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-27 07:10:44 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (resserao) [24.1.200.187]:43080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-11-27 07:12:14 dovecot_login authenticator failed for ([63.65.203.86]) [63.65.203.86]:58297: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-11-27 07:15:02 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:60706: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-27 07:15:41 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:49260: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-27 07:21:37 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:57497: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-27 07:21:51 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50541: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov 27 07:27:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, session=<lC2D14lExNRBMQG2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov 27 07:28:22 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, session=<bxoD2YlEsB9BMQG2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.47.35.194
country_id: 357994
description:
2025-11-27 07:28:46 dovecot_plain authenticator failed for (wally) [41.47.35.194]:44150: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-27 07:29:59 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:14915: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-27 07:29:21 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11963: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.245
country_id: 6252001
description:
Nov 27 07:32:38 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.36.245, lip=66.85.158.92, session=<tzZF6IlEooulmiT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-11-27 07:35:21 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:49862: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 27 07:35:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<8Gzo8YlEev/CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-27 07:35:31 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:65112: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.245
country_id: 6252001
description:
Nov 27 07:37:12 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.36.245, lip=66.85.158.91, session=<PHqZ+IlEMOylmiT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-27 07:45:46 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:39109: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-27 07:45:59 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:51456: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 07:51:20 host2 pure-ftpd[433726]: (?@175.100.116.34) [INFO] New connection from 175.100.116.34


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 07:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=175.100.116.34, lip=66.85.158.91, session=<lQVDK4pEr/GvZHQi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-27 07:54:36 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:53922: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-27 07:55:01 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:36326: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 07:58:15 host2 sshd[438605]: Disconnected from invalid user ubnt 2.57.121.112 port 62516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-27 08:03:19 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:36393: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-11-27 08:03:52 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:34548: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-27 08:06:56 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:36050: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-27 08:07:04 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:45692: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2025-11-27 08:06:45 dovecot_login authenticator failed for ([182.78.242.142]) [182.78.242.142]:52104: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-27 08:11:09 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:49898: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-27 08:10:59 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:38359: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 08:11:53 host2 pure-ftpd[448258]: (?@175.100.116.34) [INFO] New connection from 175.100.116.34


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 08:11:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=175.100.116.34, lip=66.85.158.91, session=<binAdIpEucmvZHQi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-27 08:14:10 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:39642: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-27 08:14:32 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:58187: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:17:09 host2 sshd[452795]: Disconnected from invalid user dolphinscheduler 213.6.203.226 port 34999 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:22:46 host2 sshd[455804]: Disconnected from invalid user odoo 213.6.203.226 port 39606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-11-27 08:22:29 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:49217: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:22:36 host2 sshd[455730]: Disconnected from invalid user vpn 164.90.207.105 port 54512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-27 08:22:39 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:58386: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:23:39 host2 sshd[456499]: Disconnected from invalid user hello 164.90.207.105 port 43686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:24:38 host2 sshd[457130]: Disconnected from invalid user root1 164.90.207.105 port 46282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:25:19 host2 sshd[457616]: Disconnected from invalid user old 213.6.203.226 port 48951 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 08:28:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52778: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 27 08:31:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<+UILu4pEqoWnXpI4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Nov 27 08:32:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.255, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JE5FvYpEDNXN0h//>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-27 08:32:14 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:42823: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-27 08:32:30 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:33974: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-27 08:40:10 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:45826: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-27 08:40:20 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:49280: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 08:41:17 host2 sshd[466671]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 27 08:42:37 host2 pure-ftpd[467293]: (?@184.105.139.69) [INFO] New connection from 184.105.139.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-27 08:46:51 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:33250: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.48.24.152
country_id: 1269750
description:
2025-11-27 08:47:21 dovecot_login authenticator failed for (abts-kk-dynamic-152.24.48.171.airtelbroadband.in) [171.48.24.152]:49412: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:48:46 host2 sshd[472878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:49:08 host2 sshd[473149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:50:23 host2 sshd[474237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 27 08:50:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.171, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Cwq7/opEOMrG6xir>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-27 08:51:20 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (gadickle) [67.173.58.47]:54414: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-27 08:51:23 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:34804: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-27 08:51:13 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:54774: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 27 08:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6PRWEotEgP8t4/6c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.123.61
country_id: 2921044
description:
Nov 27 08:57:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.123.61, lip=66.85.158.91, TLS, session=<rejWFotEEj1A4ns9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-27 08:58:53 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:42972: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-27 08:59:09 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:51718: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-27 09:10:50 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:59694: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-27 09:10:35 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:42986: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.184
country_id: 2635167
description:
Nov 27 09:13:15 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.184, lip=66.85.158.92, TLS, session=<UX0WUItE8bW594m4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.39
country_id: 2635167
description:
Nov 27 09:13:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.39, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PCAoUItER9pX7LAn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.56
country_id: 2635167
description:
Nov 27 09:13:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.56, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</X8jUotExce594k4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov 27 09:14:24 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.132.238, lip=66.85.158.91, session=<6MA+VItEzOGTuYTu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.54
country_id: 2635167
description:
Nov 27 09:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.54, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hUcaVotEl7i594k2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.73
country_id: 2635167
description:
Nov 27 09:14:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<WQUfVItEC+xX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.67
country_id: 2635167
description:
Nov 27 09:15:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yM8VWItE/bdX7LBD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 27 09:16:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UT8PWotESaC594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Nov 27 09:16:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.45, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<gnwMXItEEaa594kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 27 09:17:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<s+MHXotEDdy594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.63
country_id: 2635167
description:
Nov 27 09:17:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<WFIBYItEB4hX7LA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Nov 27 09:18:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<tKn8YYtE08VX7LA6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.125
country_id: 3508796
description:
2025-11-27 09:23:41 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.125]:41629: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-11-27 09:24:02 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:59996: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 09:28:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Yr8BhotENNQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:28:36 host2 sshd[503355]: Disconnected from invalid user ftpuser1 167.71.211.222 port 54598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-27 09:31:29 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:61546: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-11-27 09:31:40 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:51040: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-27 09:32:12 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.32.248]:58813: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:32:14 host2 sshd[505719]: Disconnected from invalid user admin 167.71.211.222 port 39430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:34:51 host2 sshd[506986]: Disconnected from invalid user andy 167.71.211.222 port 50852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-27 09:37:06 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:45204: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.201
country_id: 2635167
description:
Nov 27 09:36:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dkfaoYtE780jy9LJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-27 09:36:57 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:56344: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:37:25 host2 sshd[508636]: Disconnected from invalid user user3 167.71.211.222 port 44668 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 09:39:08 host2 sshd[509471]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.201
country_id: 2635167
description:
Nov 27 09:42:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.201, lip=66.85.158.91, TLS, session=<FSpmuotE1vsjy9LJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-27 09:53:00 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:44840: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-11-27 09:53:26 dovecot_login authenticator failed for ([115.248.4.85]) [115.248.4.85]:59913: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-27 09:54:32 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:53816: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 27 09:54:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<tAgY5ItEktyLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-27 09:55:21 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:50756: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-27 09:55:59 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:53116: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-27 09:56:03 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12021: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-11-27 09:56:18 dovecot_login authenticator failed for ([41.59.200.166]) [41.59.200.166]:54855: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-11-27 09:56:33 dovecot_login authenticator failed for ([31.41.84.98]) [31.41.84.98]:48139: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-27 09:58:06 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57129: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-11-27 10:03:59 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:59790: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-27 10:04:10 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:46526: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.222.34.39
country_id: 3996063
description:
2025-11-27 10:11:59 dovecot_plain authenticator failed for 189.222.34.39.dsl.dyn.telnor.net (398XN2FAL8) [189.222.34.39]:49263: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-27 10:11:22 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:63352: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-27 10:11:52 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:33512: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-27 10:15:35 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:40994: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-27 10:15:41 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:53258: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-27 10:15:53 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:53710: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-27 10:21:08 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (thish) [174.169.224.27]:57596: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.94
country_id: 6252001
description:
Nov 27 10:22:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.94, lip=66.85.158.91, session=<fUE3SIxE9uXN0h9e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 27 10:22:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<YwgrSYxE0shChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 27 10:23:06 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, session=<wZfjSYxEdhdChJmE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.117.170
country_id: 6252001
description:
Nov 27 10:24:09 host2 pure-ftpd[539728]: (?@172.202.117.170) [INFO] New connection from 172.202.117.170


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 10:26:37 host2 sshd[541711]: Disconnected from invalid user admin 2.57.121.112 port 6004 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 27 10:28:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<8uhwW4xExt9APsUR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 27 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, TLS: Connection closed, session=<H18tXIxExKdAPsUR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 27 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DdUoXIxEOopBMQGY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-27 10:35:16 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:39634: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-27 10:35:34 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:58602: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 10:41:12 host2 sshd[553207]: Disconnected from invalid user  2.57.121.112 port 62252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.156
country_id: 1733045
description:
2025-11-27 10:42:27 dovecot_login authenticator failed for ([49.124.154.156]) [49.124.154.156]:34644: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.62
country_id: 298795
description:
Nov 27 10:43:35 host2 sshd[554845]: Disconnected from invalid user master 45.94.4.62 port 4786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:44:06 host2 sshd[555236]: Disconnected from invalid user stperez 107.172.235.53 port 64560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:45:45 host2 sshd[556935]: Disconnected from invalid user ansible 185.158.23.150 port 23569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 10:46:46 host2 sshd[557417]: Disconnected from invalid user myuser 45.78.204.252 port 48860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:47:34 host2 sshd[557864]: Disconnected from invalid user user2 129.154.42.120 port 9644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:48:10 host2 sshd[558234]: Disconnected from invalid user master 185.158.23.150 port 60167 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:48:57 host2 sshd[558566]: Disconnected from invalid user jmarquez 129.154.42.120 port 25224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.62
country_id: 298795
description:
Nov 27 10:48:58 host2 sshd[558577]: Disconnected from invalid user actions 45.94.4.62 port 27908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:49:24 host2 sshd[558851]: Disconnected from invalid user zmarin 185.158.23.150 port 32695 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:50:14 host2 sshd[559460]: Disconnected from invalid user actions 107.172.235.53 port 33534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:50:16 host2 sshd[559462]: Disconnected from invalid user ansible 129.154.42.120 port 18106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:51:36 host2 sshd[560228]: Disconnected from invalid user zmarin 129.154.42.120 port 19958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:51:19 host2 sshd[560138]: Disconnected from invalid user vtatis 107.172.235.53 port 17210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-27 10:52:49 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:38666: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.49
country_id: 1269750
description:
Nov 27 10:52:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<587hr>, method=PLAIN, rip=103.18.166.49, lip=66.85.158.91, TLS, session=<ny7IsoxE04BnEqYx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.148
country_id: 798544
description:
Nov 27 10:52:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.219.105.148, lip=66.85.158.91, TLS, session=<H4JesYxERMCy22mU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-27 10:53:29 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:60838: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:53:28 host2 sshd[561201]: Disconnected from invalid user dd 107.172.235.53 port 63908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:53:10 host2 sshd[561014]: Disconnected from invalid user stperez 185.158.23.150 port 14525 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-27 10:55:07 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:40649: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-27 10:55:21 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:57458: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-27 10:57:16 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63217: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 10:56:52 host2 sshd[564535]: Disconnected from invalid user cc 107.173.160.152 port 53902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Nov 27 10:58:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.92, TLS, session=<6oMSyIxEVvfG6xjT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 10:58:34 host2 sshd[565656]: Disconnected from invalid user temp 107.173.160.152 port 57542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 10:59:39 host2 sshd[566341]: Disconnected from invalid user hb 164.92.106.89 port 54720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:00:50 host2 sshd[567196]: Disconnected from invalid user drcom 164.92.106.89 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:00:52 host2 sshd[567199]: Disconnected from invalid user admin1234 66.116.196.243 port 34018 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov 27 11:02:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<JRpg14xEnCRChJmC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:03:11 host2 sshd[569071]: Disconnected from invalid user gits 164.92.106.89 port 56278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 11:03:32 host2 sshd[569261]: Disconnected from invalid user frontend 107.173.160.152 port 51886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Nov 27 11:03:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS, session=<KSDp2oxEFO6TuYSK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 11:05:06 host2 sshd[570407]: Disconnected from invalid user redmine 107.173.160.152 port 38214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:05:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aVQZ4YxE196TuYXg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:05:26 host2 sshd[570657]: Disconnected from invalid user ionadmin 45.78.204.252 port 40466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:04:57 host2 sshd[570142]: Disconnected from invalid user update 66.116.196.243 port 42582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-27 11:05:59 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:36249: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:05:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OqEw4oxEVuqTuYXg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-11-27 11:05:45 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58357: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:05:54 host2 sshd[570950]: Disconnected from invalid user remote 164.92.106.89 port 54916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-27 11:07:41 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (dacially) [98.40.101.10]:59382: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:09:35 host2 sshd[573543]: Disconnected from invalid user vss 102.140.97.134 port 36630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.206.240
country_id: 1880251
description:
Nov 27 11:08:42 host2 sshd[572892]: Disconnected from invalid user system 47.236.206.240 port 41160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-27 11:08:52 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:37078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-27 11:09:08 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:35334: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS, session=<r8Tg84xEoOaTuYXg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:11:11 host2 sshd[574631]: Disconnected from invalid user airflow 191.185.168.78 port 49412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:11:18 host2 sshd[574709]: Disconnected from invalid user sftp 66.116.196.243 port 51872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:12:37 host2 sshd[575506]: Disconnected from invalid user gits 66.116.196.243 port 38692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:13:23 host2 sshd[575986]: Disconnected from invalid user student 102.140.97.134 port 45136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:16:02 host2 sshd[577544]: Disconnected from invalid user postgres 45.78.204.252 port 38792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:16:51 host2 sshd[578002]: Disconnected from invalid user superman 191.185.168.78 port 38512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.188.177.224
country_id: 3355338
description:
2025-11-27 11:17:05 dovecot_plain authenticator failed for (Q3OS5) [197.188.177.224]:61085: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 11:17:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1sTmDI1E0uYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 11:17:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<h4rlDY1EzJsXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.246
country_id: 2635167
description:
Nov 27 11:18:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.246, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1vLmD41ET9K594n2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:18:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<w4eXEI1EasMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.235
country_id: 2635167
description:
Nov 27 11:17:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.235, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<apzrDY1E+8lX7LDr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:18:35 host2 sshd[579152]: Disconnected from invalid user gits 45.78.204.252 port 51766 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.128
country_id: 2635167
description:
Nov 27 11:17:54 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.128, lip=66.85.158.91, TLS, session=<mBLiDY1EvYZX7LCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:18:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<q5ogEY1ErqcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.247
country_id: 2635167
description:
Nov 27 11:19:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.247, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<U0ziEY1E44FX7LD3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Nov 27 11:19:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<vrLdE41ED7lX7LD5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.220
country_id: 2635167
description:
Nov 27 11:20:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.220, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<2fzYFY1Ev7JX7LDc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:20:29 host2 sshd[580332]: Disconnected from invalid user backend 191.185.168.78 port 43400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:20:35 host2 sshd[580380]: Disconnected from invalid user dbadmin 102.140.97.134 port 35914 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:19:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<q1qWFI1ERocDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Nov 27 11:21:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<e4jPGY1E0aFX7LDy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 27 11:20:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<91TSF41EE9NX7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:21:47 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<AD7MG41EBNcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.237
country_id: 2635167
description:
Nov 27 11:21:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.237, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<r+LKG41EYZK594nt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 27 11:22:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<F0PEHY1EC6hX7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Nov 27 11:22:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JYu/H41EHexX7LDi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-27 11:23:16 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:33318: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:23:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OORbIo1Eto8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-27 11:22:49 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:58927: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:23:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<X1lHI41Eer0DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-27 11:24:32 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:45998: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-11-27 11:24:45 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:33550: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 11:26:40 host2 sshd[583838]: Disconnected from invalid user jim 2.57.121.112 port 62475 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-11-27 11:41:25 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:34161: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-27 11:41:07 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:38272: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 11:43:50 host2 sshd[595676]: Disconnected from invalid user admin 2.57.121.112 port 60656 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.79.69
country_id: 6252001
description:
Nov 27 11:46:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=198.199.79.69, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8ioic41E0tjGx09F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.99
country_id: 6252001
description:
Nov 27 11:46:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<us+fc41EMcnG6xhj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-27 11:48:51 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:59846: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-27 11:49:12 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:48776: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 11:57:13 host2 sshd[605425]: Disconnected from invalid user db2inst1 20.12.41.6 port 42542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-27 11:58:38 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61628: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-27 11:58:44 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:58720: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-27 11:58:53 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:37943: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-27 11:59:13 dovecot_login authenticator failed for ([27.123.112.90]) [27.123.112.90]:41764: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:00:12 host2 sshd[607247]: Disconnected from invalid user usuario 20.12.41.6 port 47666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:01:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AFzdqY1EurwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 12:00:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</PPbp41EEt0XXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:01:30 host2 sshd[608130]: Disconnected from invalid user soporte 20.12.41.6 port 50920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:01:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<J1qRqo1EaMkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:02:57 host2 sshd[608950]: Disconnected from invalid user ubuntu 20.12.41.6 port 40488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.33.187
country_id: 6251999
description:
2025-11-27 12:04:39 dovecot_login authenticator failed for (localhost.localdomain) [159.203.33.187]:37154: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 12:04:44 host2 sshd[610616]: Disconnected from invalid user khalid 62.60.131.157 port 26961 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:04:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2sRotY1EuMADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.28.117.27
country_id: 453733
description:
Nov 27 12:06:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=78.28.117.27, lip=66.85.158.91, TLS, session=<+coRuY1EkcxOHHUb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.15
country_id: 1269750
description:
Nov 27 12:06:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2>, method=PLAIN, rip=103.51.223.15, lip=66.85.158.91, TLS, session=<kW8zuo1Ex7dnM98P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.158
country_id: 2510769
description:
Nov 27 12:07:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=185.143.92.158, lip=66.85.158.91, TLS, session=<Q5ffvI1ERdm5j1ye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:07:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<m/YPvo1EQsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.146
country_id: 3865483
description:
Nov 27 12:07:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=45.238.106.146, lip=66.85.158.91, TLS, session=<cuM7v41Elrot7mqS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:08:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GzBZxI1EBMkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.51.202
country_id: 3017382
description:
2025-11-27 12:09:31 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:47008: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:10:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K0HXyI1EboMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-27 12:09:49 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:45091: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 12:11:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54818: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:12:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<roZq0o1EKI4DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 12:23:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<wHK/941EGpOSOC+J>


