# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:46:17 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<91ayecVCjK0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:48:09 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<92xTgMVCqNwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:50:28 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<knGZiMVCnrwDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 19:51:52 host2 sshd[2799002]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  4 19:52:35 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<bV8skMVCyLYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  4 20:00:47 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Tl+FrcVCeuZHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-04 20:01:00 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:39576: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-04 20:01:19 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (galling) [73.230.86.50]:57836: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-04 20:01:30 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:51171: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-04 20:03:22 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:36194: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-04 20:03:39 dovecot_login authenticator failed for ([1.7.83.133]) [1.7.83.133]:45098: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:10:23 host2 sshd[2818903]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 20:15:00 host2 sshd[2823790]: Invalid user Can't open saiaresur from 45.61.149.165 port 53536


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 20:18:25 host2 sshd[2827173]: Disconnected from invalid user jett 62.60.131.157 port 54268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:25:33 host2 sshd[2835570]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2025-11-04 20:26:27 dovecot_login authenticator failed for ([152.52.234.222]) [125.22.116.94]:38146: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.114
country_id: 1269750
description:
2025-11-04 20:26:10 dovecot_login authenticator failed for ([59.145.219.185]) [182.95.52.114]:43138: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.104
country_id: 6252001
description:
Nov  4 20:34:32 host2 pure-ftpd[2845719]: (?@205.210.31.104) [INFO] New connection from 205.210.31.104


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:35:06 host2 sshd[2846421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 20:40:10 host2 sshd[2851562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 20:42:59 host2 sshd[2854961]: Invalid user Can't open saiaresur from 165.232.179.250 port 36300


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.4
country_id: 6252001
description:
Nov  4 20:47:24 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.4, lip=66.85.158.92, session=<ykI9VMZCiexb5qgE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.12
country_id: 6252001
description:
Nov  4 20:47:34 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.12, lip=66.85.158.92, session=<TvvZVMZCb5pb5qgM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.0
country_id: 6252001
description:
Nov  4 20:47:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.0, lip=66.85.158.92, session=<5lGBU8ZCe41b5qgA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov  4 20:49:37 host2 pure-ftpd[2862809]: (?@194.164.107.5) [INFO] New connection from 194.164.107.5


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov  4 20:52:13 host2 pure-ftpd[2865863]: (?@199.45.155.88) [INFO] New connection from 199.45.155.88


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-11-04 20:58:38 dovecot_login authenticator failed for ([181.129.31.42]) [181.129.31.42]:48757: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-04 20:59:00 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:39954: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  4 21:01:29 host2 sshd[2875832]: Disconnected from invalid user user 2.57.121.25 port 54695 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-04 21:01:54 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:60464: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  4 21:05:05 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.91, session=<xt12k8ZCUqOUcdL+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-04 21:08:00 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:45478: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-11-04 21:07:39 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:55958: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.96
country_id: 2635167
description:
Nov  4 21:07:49 host2 dovecot[3704077]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.96, lip=66.85.158.91, TLS, session=<MdNCncZCKbK594lg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 21:11:34 host2 sshd[2888232]: Invalid user Can't open saiaresur from 165.232.179.250 port 60068


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.198.96
country_id: 6252001
description:
Nov  4 21:15:36 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.223.198.96, lip=66.85.158.92, TLS, session=<7XccucZCON+f38Zg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.5
country_id: 1880251
description:
2025-11-04 21:19:33 dovecot_login authenticator failed for (Fkkm3um) [165.154.217.5]:58947: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.217.5
country_id: 1880251
description:
2025-11-04 21:20:18 dovecot_login authenticator failed for (Yic3Ekusi) [165.154.217.5]:61556: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 21:28:04 host2 sshd[2905953]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.168.56.34
country_id: 3469034
description:
Nov  4 21:32:59 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=45.168.56.34, lip=66.85.158.91, session=<9P0Y98ZCwpktqDgi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.102.242
country_id: 290557
description:
Nov  4 21:33:25 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=80.227.102.242, lip=66.85.158.91, session=<hgKs+MZCK8FQ42by>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  4 21:33:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xkrv+MZCNGvY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov  4 21:33:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<i1W3+cZCUO24aYtD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Nov  4 21:33:49 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<marketing>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, TLS, session=<D4X5+MZCHMu0vP2W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.117.44.239
country_id: 2510769
description:
Nov  4 21:33:20 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=185.117.44.239, lip=66.85.158.91, session=<4xJV+MZCUwu5dSzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  4 21:34:09 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS: Connection closed, session=<kipr+8ZCaBnY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov  4 21:34:16 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<yTrV+8ZCdqa4aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.222
country_id: 6252001
description:
Nov  4 21:41:24 host2 pure-ftpd[2933859]: (?@64.62.156.222) [INFO] New connection from 64.62.156.222


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  4 21:48:30 host2 sshd[2955261]: Disconnected from invalid user adeline 62.60.131.157 port 29989 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov  4 21:59:10 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.91, session=<CmjsVMdCnLSUcdOD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov  4 22:02:40 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<tGllYcdCsucDWgzA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 22:15:58 host2 sshd[2988297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov  4 22:18:28 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OWfnmcdC/iZAPpzK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.108
country_id: 6252001
description:
Nov  4 22:23:28 host2 pure-ftpd[2997466]: (?@64.62.156.108) [INFO] New connection from 64.62.156.108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-04 22:27:35 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (jecheroms) [174.161.27.82]:49457: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.54
country_id: 2635167
description:
Nov  4 22:27:17 host2 dovecot[3704077]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.54, lip=66.85.158.92, TLS, session=<2911ucdCuYpX7LA2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:27:31 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<btRCusdCS8Ujy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:28:16 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<d532vMdCzucjy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.221
country_id: 2635167
description:
Nov  4 22:33:53 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.221, lip=66.85.158.92, TLS, session=<MJsK0cdCrPEjy9Ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.86
country_id: 3017382
description:
Nov  4 22:38:08 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.86, lip=66.85.158.92, session=<KdtD4MdCS8tb51lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.214
country_id: 3017382
description:
Nov  4 22:38:48 host2 dovecot[3704077]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.214, lip=66.85.158.92, session=<AcCh4sdCw5hb51nW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.215
country_id: 3017382
description:
Nov  4 22:38:51 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.215, lip=66.85.158.92, session=<nCXU4sdCpZhb51nX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.84
country_id: 3017382
description:
Nov  4 22:38:19 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.84, lip=66.85.158.92, session=<ecbo4MdCZ6pb51lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov  4 22:38:31 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<qBac4cdC6uksyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.91.250.232
country_id: 6252001
description:
Nov  4 22:48:32 host2 sshd[3025669]: Invalid user Can't open saiaresur from 168.91.250.232 port 54292


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.40.218
country_id: 6252001
description:
2025-11-04 22:54:27 dovecot_plain authenticator failed for c-68-37-40-218.hsd1.mi.comcast.net (ressitesse) [68.37.40.218]:53736: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.114
country_id: 6252001
description:
Nov  4 22:54:38 host2 pure-ftpd[3032955]: (?@198.235.24.114) [INFO] New connection from 198.235.24.114


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  4 22:55:31 host2 sshd[3034113]: Invalid user Can't open saiaresur from 103.138.237.18 port 5039


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  4 22:58:58 host2 sshd[3037839]: Invalid user Can't open saiaresur from 165.211.25.202 port 34116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  4 22:59:27 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6pF3LMhCExFAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:00:12 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<oWktL8hCwsiTuYSj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:01:26 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<sheUM8hCIuiTuYSj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  4 23:02:08 host2 sshd[3041318]: Invalid user sivagnanamfoundation from 103.239.165.114 port 43624


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 23:01:26 host2 sshd[3040577]: Invalid user Can't open saiaresur from 45.61.149.165 port 51746


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:03:08 host2 sshd[3042607]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  4 23:06:53 host2 sshd[3047375]: Invalid user sivagnanamfoundation from 103.247.20.83 port 48588


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:07:04 host2 sshd[3047588]: Invalid user Can't open saiaresur from 165.232.179.250 port 37136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:07:44 host2 sshd[3048206]: Invalid user Can't open saiaresur from 165.232.179.250 port 54414


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.163
country_id: 6252001
description:
Nov  4 23:08:41 host2 dovecot[3704077]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.163, lip=66.85.158.91, TLS, session=<mN99TchCwOOTuYSj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  4 23:09:40 host2 sshd[3050655]: Invalid user Can't open saiaresur from 45.61.149.165 port 33696


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.52.183.230
country_id: 6252001
description:
Nov  4 23:10:44 host2 pure-ftpd[3051987]: (?@13.52.183.230) [INFO] New connection from 13.52.183.230


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:10:40 host2 sshd[3051782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:11:45 host2 sshd[3053306]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-04 23:12:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  4 23:13:16 host2 sshd[3055043]: Invalid user sivagnanamfoundation from 157.245.115.125 port 50600


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  4 23:14:13 host2 sshd[3056092]: Invalid user sivagnanamfoundation from 150.95.83.190 port 54144


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  4 23:14:44 host2 sshd[3056487]: Invalid user Can't open saiaresur from 165.232.179.250 port 45824


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:17:18 host2 sshd[3059476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-04 23:20:21 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:38488: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  4 23:20:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, TLS, session=<Pt46eMhCBq4D7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-11-04 23:21:25 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:34464: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  4 23:21:46 host2 sshd[3064752]: Invalid user sivagnanamfoundation from 51.178.137.243 port 55418


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:26:40 host2 sshd[3070658]: Invalid user Can't open saiaresur from 103.84.173.178 port 60184


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:28:30 host2 sshd[3072408]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.212.246.200
country_id: 192950
description:
Nov  4 23:29:09 host2 sshd[3073135]: Invalid user sivagnanamfoundation from 102.212.246.200 port 47358


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.249.122
country_id: 2921044
description:
Nov  4 23:29:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=209.38.249.122, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</84Wl8hCTtDRJvl6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  4 23:29:46 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<+1LjmMhCdFFBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov  4 23:30:14 host2 dovecot[3704077]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<paSVmshCzhpBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-11-04 23:32:04 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:53966: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:31:35 host2 sshd[3075642]: Invalid user Can't open saiaresur from 103.84.173.178 port 42152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-04 23:32:17 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:64301: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-04 23:32:42 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:51816: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-11-04 23:32:45 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:38214: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-11-04 23:33:13 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:50516: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:34:14 host2 sshd[3078336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  4 23:34:38 host2 sshd[3078789]: Invalid user Can't open saiaresur from 103.84.173.178 port 45400


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-04 23:40:01 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:35180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-04 23:40:58 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:45641: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-04 23:41:00 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:51971: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.212
country_id: 1643084
description:
Nov  4 23:40:34 host2 sshd[3085413]: Invalid user sivagnanamfoundation from 103.146.203.212 port 41228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-04 23:41:35 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:20619: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  4 23:42:27 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<NXdJxshCSu+4aYtF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 151.254.11.76
country_id: 102358
description:
Nov  4 23:44:13 host2 pure-ftpd[3089552]: (?@151.254.11.76) [INFO] New connection from 151.254.11.76


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.251.47
country_id: 6252001
description:
Nov  4 23:46:28 host2 sshd[3092607]: Invalid user sivagnanamfoundation from 167.71.251.47 port 36272


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-04 23:48:52 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56265: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  4 23:50:39 host2 sshd[3097285]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.185.101
country_id: 2921044
description:
Nov  4 23:53:14 host2 sshd[3100177]: Invalid user sivagnanamfoundation from 164.92.185.101 port 53598


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.198.38
country_id: 1269750
description:
Nov  4 23:53:51 host2 sshd[3100732]: Invalid user sivagnanamfoundation from 66.116.198.38 port 49550


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.75
country_id: 6252001
description:
Nov  4 23:54:38 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.75, lip=66.85.158.92, TLS, session=<MIfb8chCkvyTuYRL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  4 23:55:43 host2 sshd[3103682]: Invalid user sivagnanamfoundation from 103.239.165.114 port 49094


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  4 23:56:37 host2 sshd[3104686]: Invalid user sivagnanamfoundation from 47.253.96.143 port 36636


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.63
country_id: 690791
description:
Nov  4 23:57:48 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.17.125.63, lip=66.85.158.91, TLS, session=<aJAi/MhCi9S5EX0/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.168
country_id: 6290252
description:
Nov  4 23:58:05 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.207.35.168, lip=66.85.158.91, TLS, session=<cTg3/chCaedtzyOo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  4 23:58:16 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<PE3U/shCSsNChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.115.125
country_id: 6252001
description:
Nov  4 23:59:12 host2 sshd[3107617]: Invalid user sivagnanamfoundation from 157.245.115.125 port 57818


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  5 00:00:48 host2 sshd[3109824]: Invalid user sivagnanamfoundation from 103.247.20.83 port 48730


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  5 00:01:06 host2 sshd[3110189]: Invalid user sivagnanamfoundation from 118.193.38.159 port 38612


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:02:08 host2 sshd[3111406]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.85
country_id: 6252001
description:
Nov  5 00:02:43 host2 dovecot[3704077]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rH69DslCCsXG6xhV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-11-05 00:08:45 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:43666: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-05 00:08:44 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:59958: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.46
country_id: 1733045
description:
2025-11-05 00:09:35 dovecot_login authenticator failed for ([49.124.153.46]) [49.124.153.46]:38654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.219.166.60
country_id: 6252001
description:
Nov  5 00:10:13 host2 pure-ftpd[3120606]: (?@54.219.166.60) [INFO] New connection from 54.219.166.60


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.110.157.47
country_id: 2750405
description:
Nov  5 00:11:47 host2 sshd[3122220]: Invalid user sivagnanamfoundation from 193.110.157.47 port 44182


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-05 00:12:03 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:58552: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  5 00:12:17 host2 sshd[3122806]: Invalid user sivagnanamfoundation from 143.110.213.247 port 54760


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-05 00:12:29 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:39488: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.146.21.153
country_id: 1605651
description:
Nov  5 00:15:49 host2 sshd[3126958]: Invalid user sivagnanamfoundation from 203.146.21.153 port 35408


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.212.246.200
country_id: 192950
description:
Nov  5 00:18:23 host2 sshd[3130034]: Invalid user sivagnanamfoundation from 102.212.246.200 port 51624


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  5 00:18:45 host2 sshd[3130332]: Invalid user sivagnanamfoundation from 150.95.83.190 port 33076


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 82.215.106.192
country_id: 1512440
description:
Nov  5 00:23:25 host2 pure-ftpd[3136099]: (?@82.215.106.192) [INFO] New connection from 82.215.106.192


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.152.60
country_id: 6252001
description:
Nov  5 00:24:15 host2 sshd[3137189]: Invalid user sivagnanamfoundation from 137.184.152.60 port 54536


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:28:09 host2 sshd[3141610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  5 00:27:35 host2 sshd[3140965]: Invalid user sivagnanamfoundation from 64.227.136.122 port 57808


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  5 00:27:36 host2 sshd[3141007]: Invalid user sivagnanamfoundation from 200.48.100.83 port 53108


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2025-11-05 00:27:28 dovecot_login authenticator failed for ([49.124.152.21]) [49.124.152.21]:42686: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.165
country_id: 6252001
description:
Nov  5 00:31:37 host2 sshd[3145707]: Invalid user Can't open saiaresur from 45.61.149.165 port 37558


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:34:36 host2 sshd[3148737]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-05 00:34:50 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:59626: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  5 00:35:59 host2 sshd[3150466]: Invalid user Can't open saiaresur from 165.232.179.250 port 41404


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 00:36:21 host2 sshd[3150932]: Disconnected from invalid user jacklyn 62.60.131.157 port 32016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-05 00:37:09 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:37:41 host2 sshd[3152336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-05 00:37:23 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:58413: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  5 00:37:29 host2 sshd[3152072]: Invalid user Can't open saiaresur from 103.84.173.178 port 36808


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-05 00:37:36 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:51894: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-05 00:38:39 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:34812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  5 00:39:17 host2 sshd[3154267]: Invalid user Can't open saiaresur from 165.232.179.250 port 59262


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-05 00:42:01 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:46606: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  5 00:42:11 host2 sshd[3157757]: Invalid user sivagnanamfoundation from 150.95.83.190 port 57708


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-05 00:42:25 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:36526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  5 00:42:54 host2 sshd[3158479]: Invalid user Can't open saiaresur from 103.84.173.178 port 57254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-05 00:44:10 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:55288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-11-05 00:43:36 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:38393: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 00:46:35 host2 sshd[3162873]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.153.85
country_id: 690791
description:
Nov  5 00:57:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=37.221.153.85, lip=66.85.158.91, TLS, session=<fl2Y0clCALEl3ZlV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.102
country_id: 3469034
description:
Nov  5 00:57:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.201.102, lip=66.85.158.91, TLS, session=<BeHM0slCk8izvclm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-05 01:02:28 dovecot_plain authenticator failed for (turrovet) [88.207.210.23]:60651: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:19:01 host2 sshd[3199376]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-05 01:23:15 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:37862: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-05 01:23:45 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:44970: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:25:08 host2 sshd[3206162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.237.239.173
country_id: 3077311
description:
Nov  5 01:26:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=91.237.239.173, lip=66.85.158.91, TLS, session=<yXJyOMpCBYxb7e+t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.49
country_id: 3865483
description:
Nov  5 01:26:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.225.198.49, lip=66.85.158.91, TLS, session=<2jeFOcpCNqy14cYx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-11-05 01:29:38 dovecot_plain authenticator failed for (abittutbal) [109.226.27.227]:34618: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov  5 01:30:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS: Connection closed, session=<P0z+SMpC9MZChJmN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:34:05 host2 sshd[3215928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.110.150
country_id: 1819730
description:
Nov  5 01:44:47 host2 pure-ftpd[3228183]: (?@165.154.110.150) [INFO] New connection from 165.154.110.150


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:44:33 host2 sshd[3227733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-05 01:44:55 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:40432: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-05 01:44:14 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:47000: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.204
country_id: 6252001
description:
Nov  5 01:47:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.204, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FLvchMpC89bG6xjM>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:51:47 host2 sshd[3236140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:55:42 host2 sshd[3240794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 01:57:23 host2 sshd[3242686]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:04:06 host2 sshd[3250723]: Invalid user Can't open saiaresur from 165.211.25.202 port 48810


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov  5 02:07:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<JiiGzspCrMID7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:30:52 host2 sshd[3280334]: Invalid user Can't open saiaresur from 165.211.25.202 port 57416


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 02:31:54 host2 sshd[3281417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.32
country_id: 1819730
description:
Nov  5 02:31:25 host2 pure-ftpd[3280924]: (?@45.142.154.32) [INFO] New connection from 45.142.154.32


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Nov  5 02:37:54 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.91, session=<vlPAOctCgvlC5DWu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.41.228
country_id: 6290252
description:
Nov  5 02:42:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.207.41.228, lip=66.85.158.91, TLS, session=<xNJqSstCtOBtzynk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.160
country_id: 3469034
description:
Nov  5 02:43:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.171.160, lip=66.85.158.91, TLS, session=<5VGoS8tCLbuxgqug>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 02:50:01 host2 sshd[3301966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 02:50:35 host2 sshd[3302732]: Disconnected from invalid user baby 62.60.131.157 port 6079 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov  5 02:55:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<6Bk8eMtC3OxChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov  5 02:55:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tb2feMtCBO1ChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 02:56:30 host2 sshd[3310387]: Invalid user Can't open saiaresur from 165.211.25.202 port 43462


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-11-05 02:58:26 dovecot_plain authenticator failed for (reofling) [37.34.237.45]:50950: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:15:45 host2 sshd[3331099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:18:47 host2 sshd[3334277]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 03:26:41 host2 sshd[3344922]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 03:28:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59621: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 03:31:41 host2 sshd[3351177]: Disconnected from invalid user baby 62.60.131.157 port 28233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.237.158
country_id: 3469034
description:
2025-11-05 03:35:24 dovecot_login authenticator failed for 177-84-237-158.allrede.tec.br [177.84.237.158]:37582: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-05 03:35:25 +0530] info [cpaneld] 119.28.107.251 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.101.164.140
country_id: 1861060
description:
2025-11-05 03:36:01 dovecot_login authenticator failed for 157.101.164.140.static.zoot.jp [157.101.164.140]:52370: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-05 03:36:16 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:46784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-05 03:36:17 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:46603: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 03:42:28 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<CC+eIMxCmN8D7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov  5 03:44:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FP9rJ8xCe8HN0h/f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-11-05 03:43:50 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:39150: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-05 03:44:58 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:35258: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.233
country_id: 6252001
description:
Nov  5 03:48:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZfLiNsxCAKQSYRPp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-05 03:51:20 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:55328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 03:51:41 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<WLWSQcxCoOoD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.44.143.75
country_id: 3175395
description:
2025-11-05 03:54:33 dovecot_plain authenticator failed for 93-44-143-75.ip97.fastwebnet.it (trious) [93.44.143.75]:45258: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.224.63
country_id: 6252001
description:
Nov  5 03:57:55 host2 pure-ftpd[3384981]: (?@20.127.224.63) [INFO] New connection from 20.127.224.63


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:02:10 host2 sshd[3390088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.88
country_id: 2264397
description:
Nov  5 04:03:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D780a8xCwZUtnIBY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  5 04:03:11 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<QGq1asxCs5EtnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  5 04:03:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<+vTfasxCHp4tnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.89
country_id: 2264397
description:
Nov  5 04:03:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.89, lip=66.85.158.92, TLS, session=<T7LuasxCR9AtnIBZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:06:05 host2 sshd[3396787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.82.70
country_id: 1269750
description:
Nov  5 04:06:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.30.82.70, lip=66.85.158.91, TLS, session=<E+I3dcxCiM9nHlJG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.41.76
country_id: 2300660
description:
Nov  5 04:06:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.41.76, lip=66.85.158.91, TLS, session=<Jtl6dsxCve0piylM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 04:09:09 host2 sshd[3401488]: Disconnected from invalid user rashad 62.60.131.157 port 21770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:10:24 host2 sshd[3403588]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 04:09:29 host2 sshd[3401970]: Disconnected from invalid user user 2.57.121.25 port 39384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.146
country_id: 953987
description:
2025-11-05 04:12:02 dovecot_plain authenticator failed for ([192.168.88.10]) [154.47.30.146]:36618: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Nov  5 04:12:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6/t9jcxC5cLG6xik>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:17:53 host2 sshd[3414521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-05 04:21:21 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:34988: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-05 04:21:41 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:55260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-05 04:22:02 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:40364: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-05 04:27:37 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:47720: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2025-11-05 04:27:49 dovecot_login authenticator failed for ([59.145.171.168]) [182.78.82.194]:35650: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-05 04:28:08 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:54163: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-11-05 04:28:23 dovecot_login authenticator failed for ool-43531ec7.dyn.optonline.net [67.83.30.199]:55341: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:30:57 host2 sshd[3432679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-05 04:31:31 dovecot_plain authenticator failed for (puble) [154.144.243.93]:48046: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:40:23 host2 sshd[3443052]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-05 04:40:21 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36648: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-11-05 04:40:42 dovecot_login authenticator failed for ([103.57.224.221]) [103.57.224.221]:59599: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:45:23 host2 sshd[3448637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:46:43 host2 sshd[3449833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 04:49:29 host2 sshd[3452547]: Disconnected from invalid user rashad 62.60.131.157 port 30344 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.151
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.151: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-11-05 04:52:03 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (speuole) [5.185.233.251]:34294: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:52:03 host2 sshd[3455778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-05 04:52:32 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (eusurweed) [67.172.54.29]:36772: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:52:42 host2 sshd[3456484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-11-05 04:52:37 dovecot_plain authenticator failed for (bypess) [65.20.160.107]:41618: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 04:53:56 host2 sshd[3457679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.198
country_id: 6252001
description:
Nov  5 04:53:44 host2 pure-ftpd[3457514]: (?@205.210.31.198) [INFO] New connection from 205.210.31.198


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov  5 04:58:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.236, lip=66.85.158.91, session=<ZzmdMc1C7PLN0h/s>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.36.97.172
country_id: 2635167
description:
Nov  5 05:00:23 host2 pure-ftpd[3464918]: (?@101.36.97.172) [INFO] New connection from 101.36.97.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-11-05 05:01:26 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:51211: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-05 05:00:54 dovecot_plain authenticator failed for (equie) [65.20.164.137]:60330: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.146.49.206
country_id: 6252001
description:
2025-11-05 05:01:42 dovecot_login authenticator failed for ([216.146.49.206]) [216.146.49.206]:46130: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:21 H=([100.64.100.6]) [45.154.138.32]:27011 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<admin@cloudtourssrilanka.com> rejected RCPT <geli.abraham@bbox.fr>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:14 dovecot_plain authenticator failed for ([100.64.100.6]) [45.154.138.32]:27011: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Nov  5 05:04:27 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<P2S5RM1CXpqxgqn/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.138.32
country_id: 3017382
description:
2025-11-05 05:03:30 dovecot_plain authenticator failed for ([100.64.100.6]) [45.154.138.32]:55775: 535 Incorrect authentication data (set_id=admin@cloudtourssrilanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.126
country_id: 3469034
description:
Nov  5 05:04:47 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.8.251.126, lip=66.85.158.91, TLS, session=<roj7Rc1CgrGxCPt+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 05:19:29 host2 sshd[3486253]: Disconnected from invalid user user 2.57.121.25 port 36333 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-11-05 05:24:06 dovecot_plain authenticator failed for (ovelpers) [87.121.76.190]:51958: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 05:26:26 host2 sshd[3493773]: Disconnected from invalid user tariq 62.60.131.157 port 39192 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-05 05:33:42 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:42124: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.163
country_id: 1605651
description:
2025-11-05 05:33:26 dovecot_login authenticator failed for ([110.49.145.163]) [110.49.145.163]:50846: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-05 05:36:54 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:49738: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-05 05:37:46 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:64550: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:40:57 host2 sshd[3510213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov  5 05:43:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.241, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gckM0c1C4crN0h/x>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:44:13 host2 sshd[3513425]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 05:54:04 host2 sshd[3524685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.193
country_id: 3865483
description:
Nov  5 05:59:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=190.181.101.193, lip=66.85.158.91, TLS, session=<4DcYC85C/JW+tWXB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.81
country_id: 2215636
description:
Nov  5 05:59:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=169.239.117.81, lip=66.85.158.91, TLS, session=<FC/aCc5CEO2p73VR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:05:30 host2 sshd[3537910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:13:36 host2 sshd[3546620]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-11-05 06:14:11 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:38923: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-05 06:14:16 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:35318: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-05 06:14:30 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:40848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.96
country_id: 3624060
description:
2025-11-05 06:14:51 dovecot_login authenticator failed for ([186.177.88.96]) [186.177.88.96]:48041: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:36 host2 sshd[3548751]: error: maximum authentication attempts exceeded for root from 42.3.133.38 port 50496 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:36 host2 sshd[3548751]: Disconnecting authenticating user root 42.3.133.38 port 50496: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.3.133.38
country_id: 1819730
description:
Nov  5 06:15:51 host2 sshd[3548926]: Disconnecting invalid user admin 42.3.133.38 port 51705: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-05 06:23:55 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:54455: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-05 06:24:22 dovecot_login authenticator failed for ([203.193.147.49]) [203.193.147.37]:64893: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-11-05 06:24:30 dovecot_login authenticator failed for ([85.159.165.216]) [85.159.165.216]:36478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:26:46 host2 sshd[3560515]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:28:09 host2 sshd[3562000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 06:42:58 host2 sshd[3577577]: Disconnected from invalid user citlalli 62.60.131.157 port 56517 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-05 06:43:49 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2025-11-05 06:43:25 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:55764: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-05 06:43:37 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:53554: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 06:44:53 host2 sshd[3579644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.176
country_id: 6252001
description:
Nov  5 06:47:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.176, lip=66.85.158.92, session=<aPSjtM5CRtcUQcGw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.53
country_id: 798544
description:
Nov  5 06:54:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=178.216.28.53, lip=66.85.158.91, TLS, session=<8n+Hz85CNbey2Bw1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.207
country_id: 690791
description:
Nov  5 06:55:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.207, lip=66.85.158.91, TLS, session=<EMuc0M5CFsjCLIzP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  5 07:00:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Z2mR5M5Cxo9ChJl+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:02:49 host2 sshd[3598817]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-05 07:04:00 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:34292: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-11-05 07:04:25 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:36100: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-11-05 07:04:40 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:54818: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-05 07:04:41 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:34929: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 07:06:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50518: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:07:19 host2 sshd[3604060]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  5 07:10:58 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<NQlQCs9CXNwD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 07:11:17 host2 sshd[3608341]: Disconnected from invalid user user 2.57.121.25 port 5849 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:15:47 host2 sshd[3612948]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.10
country_id: 1605651
description:
Nov  5 07:15:54 host2 pure-ftpd[3613220]: (?@103.176.152.10) [INFO] New connection from 103.176.152.10


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 07:22:26 host2 sshd[3619838]: Disconnected from invalid user citlalli 62.60.131.157 port 14266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-05 07:23:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:43172: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:23:13 host2 sshd[3620689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-05 07:24:02 dovecot_login authenticator failed for (92-62-74-41.saimanet.kg) [92.62.74.41]:58496: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-05 07:24:13 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:57797: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.151.205
country_id: 1880251
description:
2025-11-05 07:24:38 dovecot_login authenticator failed for bb116-14-151-205.singnet.com.sg [116.14.151.205]:50541: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-05 07:32:19 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:34660: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-11-05 07:32:27 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:35032: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-11-05 07:32:40 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:57345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-05 07:32:42 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:56864: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-05 07:32:41 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:34935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-05 07:32:14 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:35457: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.62
country_id: 1733045
description:
2025-11-05 07:35:22 dovecot_login authenticator failed for ([49.124.151.62]) [49.124.151.62]:59616: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-05 07:35:28 dovecot_login authenticator failed for ([128.185.214.78]) [128.185.214.78]:59428: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-05 07:35:40 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:57055: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-05 07:35:41 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:40475: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-05 07:35:47 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:59954: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-05 07:35:49 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:60596: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-05 07:36:28 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:38214: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.248.43.226
country_id: 6252001
description:
Nov  5 07:36:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.248.43.226, lip=66.85.158.91, session=<Rc4DZ89CHOY0+Cvi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 07:42:39 host2 sshd[3639899]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 07:45:28 host2 sshd[3643349]: User cloudtourssrilan from 154.47.30.146 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 07:45:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<cloudtourssrilan>, method=PLAIN, rip=154.47.30.146, lip=66.85.158.91, TLS: Connection closed, session=<fSN4hs9CIJeaLx6S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 07:46:09 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<cloudtourssrilan>, method=PLAIN, rip=154.47.30.146, lip=66.85.158.91, TLS: Connection closed, session=<+TKIh89CfKmaLx6S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.11.83
country_id: 798544
description:
Nov  5 07:49:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=89.186.11.83, lip=66.85.158.91, TLS, session=</rTBlM9C/dZZugtT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.115
country_id: 3469034
description:
Nov  5 07:50:19 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.72.115, lip=66.85.158.91, TLS, session=<O0znlc9Cfq67eEhz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov  5 07:53:52 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<X5mvo89C1IUsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-11-05 07:58:54 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:35994: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-05 07:59:43 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:51038: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.113.251
country_id: 6252001
description:
Nov  5 08:00:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.113.251, lip=66.85.158.91, session=<FkF3us9CkIysynH7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:01:29 host2 sshd[3660951]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:02:53 host2 sshd[3662313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:04:42 host2 sshd[3664591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 08:07:05 host2 sshd[3667434]: Disconnected from invalid user user 2.57.121.25 port 55485 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:08:37 host2 sshd[3668798]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov  5 08:13:24 host2 pure-ftpd[3674626]: (?@167.94.146.49) [INFO] New connection from 167.94.146.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.104
country_id: 6252001
description:
Nov  5 08:13:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.104, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Dw+r689C/M6i2JVo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.104
country_id: 6252001
description:
Nov  5 08:14:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 27 secs): user=<>, rip=162.216.149.104, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EwN67s9CBPOi2JVo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.104
country_id: 6252001
description:
Nov  5 08:15:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.104, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<d9zJ789CoPii2JVo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 08:18:06 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<cloudtourssrilan>, method=PLAIN, rip=154.47.30.146, lip=66.85.158.91, TLS: Connection closed, session=<ki04+s9CpouaLx6S>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 08:17:50 host2 sshd[3679122]: User cloudtourssrilan from 154.47.30.146 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 08:18:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=318) failed: Connection reset by peer (auth service reported temporary failure): user=<cloudtourssrilan>, method=PLAIN, rip=154.47.30.146, lip=66.85.158.91, TLS: read(size=318) failed: Connection reset by peer, session=<xQdx+s9CoM+aLx6S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.104
country_id: 6252001
description:
Nov  5 08:22:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.104, lip=66.85.158.92, TLS, session=<74+4CNBC4OKi2JVo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.127.249
country_id: 1269750
description:
2025-11-05 08:23:46 dovecot_login authenticator failed for (static.ill.117.247.82.240.bsnl.co.in) [117.222.127.249]:35074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
country_id: 690791
description:
2025-11-05 08:27:38 dovecot_login authenticator failed for rplus.dp.ua [77.109.33.120]:38882: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-11-05 08:28:17 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:19514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-05 08:28:29 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:40904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-05 08:28:10 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:40239: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:39:10 host2 sshd[3701511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 08:50:19 host2 sshd[3714979]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.154.109
country_id: 6252001
description:
Nov  5 08:52:33 host2 pure-ftpd[3717511]: (?@20.65.154.109) [INFO] New connection from 20.65.154.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-05 08:57:42 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:54043: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-11-05 08:57:11 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:46075: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.13
country_id: 1655842
description:
Nov  5 08:58:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.64.98.13, lip=66.85.158.91, TLS, session=<kjOAjNBCqqtAQGIN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 158.173.155.251
country_id: 2921044
description:
Nov  5 08:58:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=158.173.155.251, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zxt/jNBCmquerZv7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.217
country_id: 2623032
description:
Nov  5 08:58:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.126.94.217, lip=66.85.158.91, session=<im6SjNBCgqq8fl7Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.20
country_id: 130758
description:
Nov  5 08:58:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=62.133.46.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RT2XjNBCMpk+hS4U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.120.14
country_id: 798549
description:
Nov  5 08:58:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.120.14, lip=66.85.158.91, session=<iUWSjNBCfsBbWngO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.112
country_id: 6252001
description:
Nov  5 08:59:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.112, lip=66.85.158.92, session=<zkGYjdBC/MkUQGlw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:02:15 host2 sshd[3728335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.190.159.167
country_id: 6252001
description:
Nov  5 09:02:57 host2 pure-ftpd[3728954]: (?@35.190.159.167) [INFO] New connection from 35.190.159.167


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.190.159.167
country_id: 6252001
description:
Nov  5 09:02:57 host2 pure-ftpd[3728986]: (?@35.190.159.167) [INFO] New connection from 35.190.159.167


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.190.159.167
country_id: 6252001
description:
Nov  5 09:02:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.190.159.167, lip=66.85.158.91, session=<2BvFmtBCqKkjvp+n>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.104.154
country_id: 6252001
description:
Nov  5 09:03:16 host2 pure-ftpd[3730216]: (?@20.64.104.154) [INFO] New connection from 20.64.104.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-05 09:06:38 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:55404: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-05 09:06:38 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:55938: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-05 09:06:58 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:49446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-05 09:07:22 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:65340: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:09:26 host2 sshd[3737407]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.153.51.163
country_id: 6252001
description:
Nov  5 09:10:03 host2 pure-ftpd[3738353]: (?@43.153.51.163) [INFO] New connection from 43.153.51.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-05 09:10:34 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:53520: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-05 09:10:43 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:33194: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-11-05 09:10:59 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:43305: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.153.51.163
country_id: 6252001
description:
Nov  5 09:10:12 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=43.153.51.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tEWwtNBC2sErmTOj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-11-05 09:11:28 dovecot_login authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:53457: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 09:13:48 host2 sshd[3742388]: Disconnected from invalid user liana 62.60.131.157 port 52588 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.245
country_id: 6252001
description:
Nov  5 09:18:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.245, lip=66.85.158.92, session=<j14p09BCNPXG6xj1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.153.65.61
country_id: 6252001
description:
Nov  5 09:20:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=43.153.65.61, lip=66.85.158.91, TLS, session=<+QVB2dBCPs4rmUE9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:21:37 host2 sshd[3750024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-05 09:24:56 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:43168: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-05 09:24:55 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:53148: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-05 09:25:26 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:60018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.30
country_id: 1269750
description:
2025-11-05 09:25:56 dovecot_login authenticator failed for ([128.185.70.137]) [125.19.156.30]:59476: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Nov  5 09:27:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WH4T9NBCZrZChJmM>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.244
country_id: 2635167
description:
Nov  5 09:28:40 host2 pure-ftpd[3757150]: (?@185.247.137.244) [INFO] New connection from 185.247.137.244


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.97
country_id: 6252001
description:
Nov  5 09:29:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.97, lip=66.85.158.92, TLS, session=<lIQb+dBCCuyTuYRh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.112
country_id: 3175395
description:
Nov  5 09:34:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.170.112, lip=66.85.158.91, TLS, session=<CkD8CNFCxuK5D6pw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.218
country_id: 3469034
description:
Nov  5 09:33:45 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=138.255.206.218, lip=66.85.158.91, TLS, session=<cXjWB9FCQMGK/87a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-05 09:35:42 dovecot_plain authenticator failed for (magaute) [88.207.210.23]:63181: 535 Incorrect authentication data (set_id=news@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:37:08 host2 sshd[3765727]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.43
country_id: 1733045
description:
2025-11-05 09:45:09 dovecot_login authenticator failed for ([49.124.146.43]) [49.124.146.43]:45822: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-05 09:45:17 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:49008: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-05 09:45:34 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:42510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.213.224.4
country_id: 6252001
description:
2025-11-05 09:45:51 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:55578: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:48:35 host2 sshd[3777604]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 09:49:29 host2 sshd[3778690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.100.166
country_id: 2921044
description:
Nov  5 09:49:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=142.93.100.166, lip=66.85.158.91, session=<buZ8QNFCh1yOXWSm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.232.238
country_id: 2921044
description:
Nov  5 09:49:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.232.238, lip=66.85.158.91, session=<EYmCQNFC/GLRJuju>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Nov  5 09:50:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.198, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<v6BsRtFC0MXN0h/G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 09:54:57 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<dma3VNFCKo8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 09:55:21 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<am0xVtFCcqgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 09:58:53 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<9tPIYtFCvogDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-05 09:58:20 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:53752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-05 09:58:36 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:35259: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 09:59:22 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<kmSBZNFCNsYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 10:01:38 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<HROgbNFCkugDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 10:02:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<n8Xfb9FCCr4DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 10:03:38 host2 dovecot[3154217]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<YPjMc9FCZMoDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-05 10:05:17 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:59330: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-05 10:05:36 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:36646: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-05 10:05:38 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:60814: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  5 10:06:37 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Z+x6ftFCpuYDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 10:07:54 host2 sshd[3799883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.97
country_id: 6252001
description:
Nov  5 10:09:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.97, lip=66.85.158.91, TLS, session=<j3taiNFCHO+TuYRh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2025-11-05 10:13:56 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:56448: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-11-05 10:14:23 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:43926: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-05 10:15:04 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:44723: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-05 10:17:11 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:54798: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-05 10:17:11 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:44128: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-11-05 10:17:19 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:49254: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-05 10:17:29 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:59718: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-05 10:17:30 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:35865: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-11-05 10:17:25 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:56564: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-11-05 10:17:42 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:34958: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-05 10:18:17 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:52198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 10:24:40 host2 sshd[3817601]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 10:30:11 host2 sshd[3822534]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.220
country_id: 6252001
description:
Nov  5 10:30:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.220, lip=66.85.158.91, session=<EDD/09FCYQtAPsXc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov  5 10:30:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.212, lip=66.85.158.91, TLS: Connection closed, session=<GLLA1NFCSuVAPsXU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 10:44:18 host2 sshd[3838841]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-11-05 10:44:28 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (browens) [217.215.74.195]:35078: 535 Incorrect authentication data (set_id=news@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.146
country_id: 690791
description:
Nov  5 10:44:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.103.1.146, lip=66.85.158.91, TLS, session=<3uFfBdJCeJuwZwGS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.138
country_id: 3469034
description:
Nov  5 10:44:19 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=138.36.202.138, lip=66.85.158.91, TLS, session=<KGAgBNJCCpaKJMqK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 10:45:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56901: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 10:49:20 host2 sshd[3845997]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-05 10:51:06 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:44042: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-11-05 10:51:29 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:59639: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.227
country_id: 6252001
description:
Nov  5 10:52:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.227, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Y2UDItJCJdei2Jbj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.96
country_id: 2264397
description:
Nov  5 10:58:51 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.96, lip=66.85.158.91, TLS, session=<gy5GOdJC0dwtnIBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.96
country_id: 2264397
description:
Nov  5 10:58:54 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.156.128.96, lip=66.85.158.91, session=<trhsOdJCQLEtnIBg>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.98
country_id: 2264397
description:
Nov  5 10:58:57 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.98, lip=66.85.158.91, TLS, session=<uuiZOdJC14YtnIBi>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.97
country_id: 2264397
description:
Nov  5 10:58:50 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.97, lip=66.85.158.91, session=<i786OdJC474tnIBh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.98
country_id: 2264397
description:
Nov  5 10:58:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1vdPOdJCH4MtnIBi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.99
country_id: 2264397
description:
Nov  5 10:58:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.128.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<JGKNOdJCybktnIBj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-11-05 10:59:21 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (callic) [90.0.156.128]:39692: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.227
country_id: 6252001
description:
Nov  5 10:59:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.227, lip=66.85.158.91, TLS, session=<V31RPNJC4vai2Jbj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.99.118
country_id: 3077311
description:
Nov  5 11:03:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=176.98.99.118, lip=66.85.158.91, TLS, session=<evPASNJC88WwYmN2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.34.2
country_id: 3469034
description:
Nov  5 11:03:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=189.127.34.2, lip=66.85.158.91, TLS, session=</LbfSdJCk+u9fyIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-11-05 11:05:42 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (cosies) [93.145.118.40]:33910: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-05 11:05:45 dovecot_plain authenticator failed for (sienoid) [65.20.174.63]:35662: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 11:07:08 host2 sshd[3868796]: Disconnected from invalid user armani 62.60.131.157 port 25279 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov  5 11:08:10 host2 pure-ftpd[3870006]: (?@167.94.146.60) [INFO] New connection from 167.94.146.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-11-05 11:10:04 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:34406: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.208.233
country_id: 6252001
description:
2025-11-05 11:10:06 dovecot_login authenticator failed for 75.97.208.233.res-cmts.blm.ptd.net [75.97.208.233]:54226: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-05 11:10:27 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:34754: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.101.164.140
country_id: 1861060
description:
2025-11-05 11:10:52 dovecot_login authenticator failed for 157.101.164.140.static.zoot.jp [157.101.164.140]:41780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
country_id: 6252001
description:
2025-11-05 11:18:00 dovecot_login authenticator failed for (c-50-190-139-137.unallocated.comcastbusiness.net) [50.190.139.137]:49921: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.199.12.218
country_id: 2802361
description:
2025-11-05 11:18:57 dovecot_login authenticator failed for d54c70cda.static.telenet.be [84.199.12.218]:55538: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-11-05 11:18:42 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:52670: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.150
country_id: 6252001
description:
Nov  5 11:24:21 host2 pure-ftpd[3888311]: (?@205.210.31.150) [INFO] New connection from 205.210.31.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-05 11:24:33 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:47798: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-05 11:25:16 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:42965: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.212.55
country_id: 6251999
description:
Nov  5 11:31:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=148.113.212.55, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9112rdJCzI2UcdQ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.99
country_id: 6252001
description:
Nov  5 11:41:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<t6Pg0dJC2t7G6xhj>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.90
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.90: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.231
country_id: 3175395
description:
Nov  5 11:54:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.70.204.231, lip=66.85.158.91, TLS, session=<8NzJANNC2oNtRszn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.113
country_id: 953987
description:
Nov  5 11:55:17 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.54.113, lip=66.85.158.91, TLS, session=<9zr8AdNCYtRmgTZx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-11-05 12:06:51 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:57776: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.98.27.178
country_id: 3175395
description:
2025-11-05 12:07:08 dovecot_login authenticator failed for host-5-98-27-178.business.telecomitalia.it [5.98.27.178]:46245: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.167
country_id: 6252001
description:
Nov  5 12:07:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.167, lip=66.85.158.91, TLS, session=<rHdSMNNCwu/G6xin>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-05 12:11:27 dovecot_plain authenticator failed for (ompterist) [178.250.191.189]:50428: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.64
country_id: 6252001
description:
Nov  5 12:12:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.64, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PGe6QdNCHMDG6xhA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 12:21:11 host2 sshd[3949615]: Disconnected from invalid user milton 62.60.131.157 port 30143 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.207.80
country_id: 2802361
description:
Nov  5 12:22:14 host2 pure-ftpd[3950756]: (?@34.140.207.80) [INFO] New connection from 34.140.207.80


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov  5 12:22:54 host2 sshd[3951290]: Disconnected from invalid user ot 190.167.237.191 port 45356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-05 12:53:13 dovecot_login authenticator failed for ([128.185.199.14]) [128.185.199.14]:59196: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-05 12:53:25 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:33838: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Nov  5 12:56:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ELu73tNCd+NX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.13
country_id: 2635167
description:
Nov  5 12:57:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.13, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bxS34NNCkaVX7LAN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.221
country_id: 2635167
description:
Nov  5 12:56:41 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.221, lip=66.85.158.92, TLS, session=<Vk6k3tNCD+K594nd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.12
country_id: 2635167
description:
Nov  5 12:58:22 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.12, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<hsWt5NNCWYFX7LAM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.30
country_id: 2635167
description:
Nov  5 12:57:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.30, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<F2iy4tNCRcC594ke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.2
country_id: 2635167
description:
Nov  5 12:58:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.2, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<xv2o5tNClei594kC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Nov  5 12:59:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VYOi6NNCWZRX7LAl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.32
country_id: 2635167
description:
Nov  5 13:00:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.32, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<adqf6tNC3dNX7LAg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.13
country_id: 2635167
description:
Nov  5 13:00:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.13, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5imb7NNCJai594kN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Nov  5 13:01:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<5YeU7tNCMei594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.21
country_id: 2635167
description:
Nov  5 13:01:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Ht+P8NNCi4RX7LAV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  5 13:07:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OtyDBdRCIrZChJl7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.54
country_id: 732800
description:
Nov  5 13:07:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.255.215.54, lip=66.85.158.91, TLS, session=<6zudBNRCBIe5/9c2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.129.252
country_id: 690791
description:
Nov  5 13:07:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.129.252, lip=66.85.158.91, TLS, session=<3giuBdRC+pcl3YH8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.37.239.123
country_id: 294640
description:
2025-11-05 13:19:14 dovecot_plain authenticator failed for (quirt) [89.37.239.123]:33034: 535 Incorrect authentication data (set_id=news@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-05 13:22:00 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (exilariess) [67.172.54.29]:38666: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 13:35:06 host2 sshd[4029766]: Disconnected from invalid user deangelo 62.60.131.157 port 19170 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.195.251.244
country_id: 1269750
description:
Nov  5 13:42:22 host2 pure-ftpd[4037383]: (?@103.195.251.244) [INFO] New connection from 103.195.251.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-05 13:53:41 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:48036: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-11-05 13:53:58 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:53140: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Nov  5 13:55:33 host2 kernel: php[4051394]: segfault at 24b5b40 ip 00007faabb945e31 sp 00007ffda67f07e8 error 4 in libc-2.28.so[7faabb89b000+1cd000]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.62
country_id: 2750405
description:
Nov  5 13:58:25 host2 pure-ftpd[4054253]: (?@196.251.87.62) [INFO] New connection from 196.251.87.62


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.87.61
country_id: 2750405
description:
Nov  5 13:58:26 host2 sshd[4054257]: Invalid user info@idesignvector.com from 196.251.87.61 port 50626


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
country_id: 3469034
description:
2025-11-05 14:00:04 dovecot_login authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:37266: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 13:59:45 host2 sshd[4055827]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-05 14:00:31 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:54367: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.165.106
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 154.213.165.106 - admin_venee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_venee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.242.144
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 216.26.242.144 - topviewuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topviewuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.252.78
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 216.26.252.78 - topview "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topview (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.20.255
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 65.111.20.255 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 14:10:21 host2 sshd[4066843]: Disconnected from invalid user brook 62.60.131.157 port 60034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.193.223
country_id: 2750405
description:
Nov  5 14:13:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.22.193.223, lip=66.85.158.92, session=<FboL8tRCzuOlFsHf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  5 14:15:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<KMI7+dRCvLojygmF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.193.17
country_id: 2750405
description:
Nov  5 14:17:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.193.17, lip=66.85.158.91, session=<yZVD/9RCuIOfQcER>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 14:24:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63060: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 14:30:23 host2 sshd[4084227]: Invalid user Can't open saiaresur from 165.211.25.202 port 56774


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 14:31:33 host2 sshd[4085205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.219.229.99
country_id: 6252001
description:
2025-11-05 14:32:21 dovecot_login authenticator failed for (67-219-229-99.mycomspan.com) [67.219.229.99]:45812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-05 14:31:53 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:60758: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.72.225.244
country_id: 660013
description:
2025-11-05 14:31:58 dovecot_login authenticator failed for 3e48e1f4.adsl.multi.fi [62.72.225.244]:54678: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.160.146
country_id: 3469034
description:
2025-11-05 14:33:02 dovecot_login authenticator failed for ([191.59.160.146]) [191.59.160.146]:53572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  5 14:36:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<2el+QtVCR88tKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  5 14:36:42 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<M9NURNVCIbEtKyHS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.5.158
country_id: 290557
description:
2025-11-05 14:39:36 dovecot_login authenticator failed for ([5.31.5.158]) [5.31.5.158]:40176: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 14:46:56 host2 sshd[4098734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  5 14:48:33 host2 sshd[4100001]: Invalid user Can't open saiaresur from 165.211.25.202 port 50476


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 14:52:21 host2 sshd[4103428]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-05 14:55:03 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:40804: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-05 14:54:42 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:45418: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.252
country_id: 2300660
description:
Nov  5 15:00:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=41.139.47.252, lip=66.85.158.91, TLS, session=</SiCl9VCZbopiy/8>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.130
country_id: 2635167
description:
Nov  5 15:00:00 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.130, lip=66.85.158.91, TLS, session=<Sdunl9VC65C594mC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov  5 15:00:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<UIXQl9VCP85X7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.84
country_id: 2635167
description:
Nov  5 15:00:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.84, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<S9fLmdVCN5ZX7LBU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.86
country_id: 3469034
description:
Nov  5 15:00:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.130.86, lip=66.85.158.91, TLS, session=<Lin6mNVChsO/NYJW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Nov  5 15:01:09 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<zSPHm9VCI+VX7LBK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Nov  5 15:01:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<GWDCndVC/clX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.101
country_id: 2635167
description:
Nov  5 15:02:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.101, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<e8u9n9VCZaJX7LBl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.109
country_id: 2635167
description:
Nov  5 15:03:22 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.109, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<BJa0o9VCqa1X7LBt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Nov  5 15:02:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NTq3odVChe1X7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Nov  5 15:03:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zr6vpdVCV8u594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Nov  5 15:04:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<GCWpp9VCG8ZX7LBR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.109
country_id: 2635167
description:
Nov  5 15:05:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.109, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<PYGkqdVCIb5X7LBt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-05 15:05:26 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:48261: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-11-05 15:05:52 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:41331: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.24
country_id: 1733045
description:
2025-11-05 15:06:29 dovecot_login authenticator failed for ([49.124.151.24]) [49.124.151.24]:47202: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2025-11-05 15:06:49 dovecot_login authenticator failed for 195-128-241-207.bredband.obenetwork.net [195.128.241.207]:46149: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.56
country_id: 2635167
description:
Nov  5 15:07:34 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.56, lip=66.85.158.91, TLS, session=<j8S2stVCQbS594k4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-05 15:16:54 dovecot_plain authenticator failed for 5.185.189.151.ipv4.public.orange.pl (elomy) [5.185.189.151]:59278: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-05 15:18:22 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:35930: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-05 15:26:31 dovecot_plain authenticator failed for (tapprecty) [65.20.233.110]:39002: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.30
country_id: 6252001
description:
Nov  5 15:35:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.30, lip=66.85.158.92, session=<qejtFtZCEb9b5qge>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 15:35:13 host2 sshd[4142504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.28
country_id: 6252001
description:
Nov  5 15:35:45 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.28, lip=66.85.158.92, session=<HN+IF9ZCoe1b5qgc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.16
country_id: 6252001
description:
Nov  5 15:35:53 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.16, lip=66.85.158.92, session=<tWoDGNZCf6Zb5qgQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.23
country_id: 6252001
description:
Nov  5 15:35:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.23, lip=66.85.158.92, session=<hokzGNZCAcxb5qgX>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 15:40:18 host2 sshd[4146939]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 15:48:37 host2 sshd[4155018]: Disconnected from invalid user user 2.57.121.25 port 16543 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-05 15:50:05 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (asular) [73.13.220.220]:55640: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 16:01:18 host2 sshd[4166575]: Disconnected from invalid user graciela 62.60.131.157 port 18869 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-05 16:04:47 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52772: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-05 16:05:14 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:42284: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 16:07:02 host2 sshd[4172607]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 16:16:52 host2 sshd[4183322]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.61
country_id: 2750405
description:
Nov  5 16:18:18 host2 pure-ftpd[4185378]: (?@196.251.87.61) [INFO] New connection from 196.251.87.61


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 16:36:12 host2 sshd[10154]: Disconnected from invalid user princess 62.60.131.157 port 32091 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 16:36:09 host2 sshd[10022]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 16:41:06 host2 sshd[15787]: Disconnected from invalid user user 2.57.121.25 port 24212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.93
country_id: 798544
description:
Nov  5 16:59:05 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=195.205.4.93, lip=66.85.158.91, TLS, session=<vvyEQNdC8rjDzQRd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.185
country_id: 3175395
description:
Nov  5 16:59:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.185, lip=66.85.158.91, TLS, session=<fcmvQddC1Zq5xQm5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.235.28
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.56.235.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov  5 17:04:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gt5SVNdCWKFChJl5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 17:10:50 host2 sshd[47638]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.26.57
country_id: 2921044
description:
Nov  5 17:14:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.26.57, lip=66.85.158.92, session=<CSuld9dC2zGf3xo5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.134.212
country_id: 2921044
description:
Nov  5 17:14:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.134.212, lip=66.85.158.92, session=<GF2rd9dCPPmLO4bU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2025-11-05 17:19:47 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:44890: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-05 17:20:09 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:34644: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 17:29:20 host2 sshd[66788]: Disconnected from invalid user user 2.57.121.25 port 5401 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-05 17:34:04 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:49866: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-11-05 17:34:06 dovecot_login authenticator failed for ([50.79.249.83]) [50.79.249.83]:11357: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.86
country_id: 1269750
description:
2025-11-05 17:33:51 dovecot_login authenticator failed for ([122.186.249.6]) [116.193.128.86]:37728: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-05 17:34:23 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:33298: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-05 17:34:56 dovecot_login authenticator failed for (abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:47130: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 17:42:49 host2 sshd[82003]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-05 17:42:40 dovecot_plain authenticator failed for (pefeboof) [5.76.44.40]:45665: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  5 17:42:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<r/Ac3tdChqNChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:48:57 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Ojbr89dCtqQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:49:56 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<L1Fj99dCVtwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:50:22 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<ZMH8+NdCyusDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:51:20 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<fhVt/NdCMpkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:52:35 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jI/bANhCwsQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:53:32 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<DrJIBNhChuEDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:54:00 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jQ71BdhCvrsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:54:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<6JEPCdhCuIIDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:55:02 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Gh2fCdhC8oEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:56:02 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wlI4DdhCcNgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 17:57:01 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<zWTAENhClpcDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-11-05 18:10:43 dovecot_login authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:36773: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-11-05 18:11:10 dovecot_login authenticator failed for ([125.19.171.126]) [152.52.197.174]:38354: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-05 18:14:48 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:46221: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-11-05 18:15:01 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:41136: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:14:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=</bzZT9hCOssDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:15:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nD7TUthCzpsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:17:04 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sMd1WNhCCNgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.195
country_id: 3175395
description:
Nov  5 18:16:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=194.60.212.195, lip=66.85.158.91, TLS, session=<jGo5VNhCXIXCPNTD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.53.112
country_id: 3469034
description:
Nov  5 18:16:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=170.82.53.112, lip=66.85.158.91, TLS, session=<3r+VVdhCu72qUjVw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.85
country_id: 3017382
description:
Nov  5 18:17:39 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.85, lip=66.85.158.92, session=<ARKNWthCx7Vb51lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Nov  5 18:17:50 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.209, lip=66.85.158.92, session=<FHExW9hClYtb51nR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.208
country_id: 3017382
description:
Nov  5 18:18:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.208, lip=66.85.158.92, session=<AxTCXNhC/9Zb51nQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 18:18:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58605: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:18:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1+OkXdhCdoUDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.33.179
country_id: 1269750
description:
2025-11-05 18:18:51 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [49.43.33.179]:52350: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.82
country_id: 3017382
description:
Nov  5 18:18:13 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.82, lip=66.85.158.92, session=<prWPXNhCu5Rb51lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:19:21 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<bJOjYNhCNNoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-05 18:19:24 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:41525: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-05 18:19:32 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:63012: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-05 18:19:58 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:59420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:20:50 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<FCrxZdhCfL8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:22:52 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Qns0bdhC9JUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:23:27 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RpRBb9hCcs8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:24:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<CWkAdNhCaOkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  5 18:25:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<dpv3dthCWrsDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 18:26:16 host2 sshd[135278]: Disconnected from invalid user selina 62.60.131.157 port 15009 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.5.158
country_id: 290557
description:
2025-11-05 18:30:34 dovecot_plain authenticator failed for (tousnespip) [5.31.5.158]:54579: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-05 18:30:38 dovecot_plain authenticator failed for (lueantly) [87.200.226.113]:56237: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.88.225.146
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 183.88.225.146 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-05 18:37:35 dovecot_plain authenticator failed for (setradic) [24.187.213.29]:51304: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 18:46:54 host2 sshd[159759]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 143.208.0.168
country_id: 3469034
description:
2025-11-05 18:47:36 H=(87.117.231.66) [143.208.0.168]:51980 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <orange@imobust.com>: Sender verify failed


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 18:52:30 host2 sshd[165708]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.83
country_id: 798544
description:
Nov  5 18:53:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=78.11.95.83, lip=66.85.158.91, TLS, session=<NhXn2dhCoIVOC19T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.3
country_id: 3469034
description:
Nov  5 18:53:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.250.3, lip=66.85.158.91, TLS, session=<U48b29hCYcu60foD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 19:00:52 host2 sshd[175867]: Disconnected from invalid user geoffrey 62.60.131.157 port 37886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 19:10:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<cloudtourssrilan>, method=PLAIN, rip=154.47.30.146, lip=66.85.158.91, TLS: Connection closed, session=<ib20FdlCUKyaLx6S>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 154.47.30.146
country_id: 953987
description:
Nov  5 19:09:45 host2 sshd[185318]: User cloudtourssrilan from 154.47.30.146 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-05 19:09:54 dovecot_plain authenticator failed for (matisretts) [5.32.107.6]:59498: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 19:16:46 host2 sshd[193330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 19:19:08 host2 sshd[195712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-05 19:22:22 dovecot_plain authenticator failed for (gonaly) [65.20.155.223]:32812: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov  5 19:24:40 host2 pure-ftpd[201600]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 19:26:05 host2 sshd[203000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-05 19:32:57 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:58162: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-11-05 19:33:18 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:39081: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 19:35:06 host2 sshd[212658]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 19:38:21 host2 sshd[216563]: Disconnected from invalid user geoffrey 62.60.131.157 port 55401 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.205.153.133
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 170.205.153.133 - colourmarklabelscom "GET /login/?login_only=1&user=colourmarklabelscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabelscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.239.125.244
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.239.125.244 - colourmarklabel "GET /login/?login_only=1&user=colourmarklabel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.149.12.149
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.149.12.149 - colourmarklabe "GET /login/?login_only=1&user=colourmarklabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.207.100.136
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 69.207.100.136 - colourmarklab "GET /login/?login_only=1&user=colourmarklab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.124.76.248
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 70.124.76.248 - colourmar "GET /login/?login_only=1&user=colourmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.233.58
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.243.233.58 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.187.144.147
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.187.144.147 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.200.218.116
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.200.218.116 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.12.41.224
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.12.41.224 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.107.133.137
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.107.133.137 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.60.144.12
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.60.144.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.162.210.144
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.162.210.144 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.126.90.49
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.126.90.49 - colourmarkl "GET /login/?login_only=1&user=colourmarkl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.227.146
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.160.227.146 - colourmark "GET /login/?login_only=1&user=colourmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmark (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.7.65.166
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 69.7.65.166 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.27.61.250
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.27.61.250 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.30.89.45
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 98.30.89.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.112.41
country_id: 1819730
description:
Nov  5 19:43:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.112.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PqXUjtlCLvWlmnAp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.127.147.242
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.127.147.242 - colourmarkla "GET /login/?login_only=1&user=colourmarkla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.102.150.198
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 50.102.150.198 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.46
country_id: 1819730
description:
Nov  5 19:44:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.46, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Z12vkNlCEsQtjpou>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.133.193.13
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.133.193.13 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.126.100.216
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.126.100.216 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.117.199
country_id: 1819730
description:
Nov  5 19:44:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.117.199, lip=66.85.158.91, TLS, session=<HZ7SkNlCVhplJHXH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-05 19:48:35 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (supectae) [81.226.88.121]:36309: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-05 19:55:11 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:40262: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-11-05 19:55:31 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:51839: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-11-05 19:56:24 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:33619: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
country_id: 1269750
description:
2025-11-05 19:56:51 dovecot_login authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:34540: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:23:32 host2 sshd[266213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.102.134.12
country_id: 3077311
description:
Nov  5 20:24:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=176.102.134.12, lip=66.85.158.91, TLS, session=<EirRINpCrN2wZoYM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.227
country_id: 3175395
description:
Nov  5 20:25:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.178.227, lip=66.85.158.91, TLS, session=<grHhIdpCcdy5RLLj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:31:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VzMlOdpCT9yTuYXz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:32:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Ex1FPdpCYO+TuYXz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  5 20:34:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<CHewRdpCwN6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov  5 20:36:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS: Connection closed, session=<uVWSTNpCFK1ChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-05 20:37:01 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:33224: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.243
country_id: 6252001
description:
Nov  5 20:40:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.243, lip=66.85.158.91, TLS, session=<phBxWNpCVPqTuYXz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:44:56 host2 sshd[288461]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 20:55:51 host2 sshd[302061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.244
country_id: 6252001
description:
Nov  5 21:05:12 host2 pure-ftpd[313987]: (?@205.210.31.244) [INFO] New connection from 205.210.31.244


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:11:47 host2 sshd[322088]: Disconnected from invalid user devuser 20.109.73.208 port 51646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:13:52 host2 sshd[324403]: Disconnected from invalid user ahsan 101.36.109.176 port 57240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.116
country_id: 6252001
description:
Nov  5 21:15:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MPvQ1dpCOZFBMQF0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:14:30 host2 sshd[325047]: Disconnected from invalid user mario 119.92.70.82 port 54614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:14:56 host2 sshd[325429]: Disconnected from invalid user ubuntu 20.109.73.208 port 46806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Nov  5 21:15:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<317l1tpCYsNBMQFs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:15:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 26 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IL3G19pCjMGTuYRN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:16:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<h85429pClOeTuYRN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:17:13 host2 sshd[328005]: Disconnected from invalid user lzj 20.109.73.208 port 43636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:19:14 host2 sshd[330175]: Disconnected from invalid user test 119.92.70.82 port 58024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:21:07 host2 sshd[332363]: Disconnected from invalid user admin 101.36.109.176 port 37480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov  5 21:22:18 host2 sshd[333595]: Disconnected from invalid user dev 119.92.70.82 port 60298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:22:33 host2 sshd[333820]: Disconnected from invalid user postgres 101.36.109.176 port 39138 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:24:00 host2 sshd[335114]: Disconnected from invalid user postgres 101.36.109.176 port 35018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  5 21:24:16 host2 sshd[335429]: Disconnected from invalid user elyse 62.60.131.157 port 26919 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.180.196.165
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 207.180.196.165 - jrdclk_water_test_user "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user jrdclk_water_test_user (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.109.73.208
country_id: 6252001
description:
Nov  5 21:23:38 host2 sshd[334850]: Disconnected from invalid user webuser 20.109.73.208 port 60530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Nov  5 21:25:25 host2 sshd[336818]: Disconnected from invalid user hamza 101.36.109.176 port 44772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:24:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS, session=<RIkR99pCAveTuYRN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.77
country_id: 6252001
description:
Nov  5 21:25:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.77, lip=66.85.158.92, TLS, session=<BOVQ+tpCeuaTuYRN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:26:42 host2 sshd[338003]: Disconnected from invalid user pentaho 209.38.228.14 port 47338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.232
country_id: 3469034
description:
Nov  5 21:27:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=45.183.92.232, lip=66.85.158.91, TLS, session=<eFb//9pC+9gtt1zo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.102.137.15
country_id: 3077311
description:
Nov  5 21:27:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.102.137.15, lip=66.85.158.91, TLS, session=<w00tAdtCUIuwZokP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:29:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<NrzhB9tCiJ4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:29:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wp+GCdtCvNsDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:30:22 host2 sshd[341730]: Disconnected from invalid user headscale 209.38.228.14 port 47144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:31:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lm00D9tChMMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:32:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<eM3+FNtCitUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:35:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4i2XHNtCYIcDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:34:49 host2 sshd[346550]: Disconnected from invalid user esuser 209.38.228.14 port 50266 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:35:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+u+yHttC2r8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.38.228.14
country_id: 2921044
description:
Nov  5 21:37:09 host2 sshd[349122]: Disconnected from invalid user cherry 209.38.228.14 port 32960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  5 21:36:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<c3FAIttCltwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:39:33 host2 sshd[351443]: Disconnected from invalid user bot2 181.104.58.194 port 54148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 21:41:51 host2 sshd[353768]: Disconnected from invalid user user 2.57.121.25 port 41919 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:46:24 host2 sshd[371742]: Disconnected from invalid user ansadmin 181.104.58.194 port 45272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.104.58.194
country_id: 3865483
description:
Nov  5 21:48:07 host2 sshd[373600]: Disconnected from invalid user javier 181.104.58.194 port 50114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.204.149
country_id: 6252001
description:
Nov  5 21:50:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.80.204.149, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZON9VNtCMqYoUMyV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov  5 21:52:49 host2 sshd[378442]: Invalid user visionsolutionshospital from 154.219.110.64 port 49396


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:00:14 host2 sshd[387029]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.237.239.173
country_id: 3077311
description:
Nov  5 22:02:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=91.237.239.173, lip=66.85.158.91, TLS, session=<Qz6tfNtCU9Fb7e+t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.242.162
country_id: 1269750
description:
Nov  5 22:02:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=103.18.242.162, lip=66.85.158.91, TLS, session=<+4/vfdtCWdhnEvKi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-05 22:09:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:13:31 host2 sshd[400923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.131.247
country_id: 6252001
description:
Nov  5 22:25:42 host2 pure-ftpd[414716]: (?@54.174.131.247) [INFO] New connection from 54.174.131.247


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 22:29:15 host2 sshd[418959]: Disconnected from invalid user user 2.57.121.25 port 16459 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov  5 22:30:18 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.91, TLS, session=<ARcX4ttCHJpHBobp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.90
country_id: 6252001
description:
Nov  5 22:31:09 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.90, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GLgb5dtCspEUqWla>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 22:32:09 host2 sshd[422502]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-05 22:34:58 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:52180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-05 22:35:26 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:53808: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:39:22 host2 sshd[430503]: Disconnected from invalid user sample 103.172.154.255 port 37226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov  5 22:39:51 host2 sshd[431032]: Disconnected from invalid user mauro 103.186.1.59 port 41140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov  5 22:42:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<5OtoDNxCzt5ChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov  5 22:42:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, session=<YYnbDNxCkq5APpxC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:42:19 host2 sshd[433869]: Disconnected from invalid user steam 103.172.154.255 port 36070 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov  5 22:42:42 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, session=<3OZsDtxCElNAPpxC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:43:03 host2 sshd[434553]: Disconnected from invalid user oracle 103.172.154.255 port 56520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Nov  5 22:43:46 host2 sshd[435435]: Disconnected from invalid user hadoop 103.172.154.255 port 60712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:44:27 host2 sshd[436095]: Disconnected from invalid user yhx 138.99.80.102 port 58648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:44:41 host2 sshd[436316]: Disconnected from invalid user dipesh 103.218.240.181 port 34664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:46:13 host2 sshd[438423]: Disconnected from invalid user xy 103.218.240.181 port 53086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov  5 22:45:37 host2 sshd[437836]: Disconnected from invalid user emo 103.186.1.59 port 42976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:47:33 host2 sshd[440168]: Disconnected from invalid user user 138.99.80.102 port 33300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:47:45 host2 sshd[440320]: Disconnected from invalid user john 103.218.240.181 port 33484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:50:54 host2 sshd[443657]: Disconnected from invalid user vncuser 103.218.240.181 port 45396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov  5 22:52:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, session=<JuVuMdxCaiRBMQEY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov  5 22:52:35 host2 sshd[445506]: Disconnected from invalid user developer 103.218.240.181 port 38472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov  5 22:52:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS: Connection closed, session=<YnguMtxC9ohBMQEY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:55:07 host2 sshd[448830]: Disconnected from invalid user aaron 138.99.80.102 port 36228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 22:56:50 host2 sshd[450556]: Disconnected from invalid user ftpuser 202.70.82.95 port 8156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Nov  5 22:57:57 host2 sshd[451789]: Disconnected from invalid user jirka 138.99.80.102 port 43098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:00:17 host2 sshd[454402]: Disconnected from invalid user tommy 202.70.82.95 port 51274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-05 23:00:36 dovecot_plain authenticator failed for (xybral) [65.20.155.223]:32922: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.200
country_id: 6252001
description:
Nov  5 23:05:01 host2 pure-ftpd[459566]: (?@205.210.31.200) [INFO] New connection from 205.210.31.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.161.157
country_id: 3865483
description:
2025-11-05 23:06:42 dovecot_login authenticator failed for (157.161.185.190.cable.dyn.ridsa.com.ar) [190.185.161.157]:49099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.45.2.93
country_id: 3573591
description:
2025-11-05 23:07:06 dovecot_login authenticator failed for 186-45-2-93.dynamic.tstt.net.tt [186.45.2.93]:44187: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:09:46 host2 sshd[464535]: Disconnected from invalid user ftpuser 202.70.82.95 port 64064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:11:36 host2 sshd[466561]: Disconnected from invalid user git 198.98.56.205 port 52114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-05 23:12:52 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:13660: 535 Incorrect authentication data (set_id=hr@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Nov  5 23:13:22 host2 sshd[468363]: Disconnected from invalid user hi 202.152.201.166 port 39824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov  5 23:14:42 host2 sshd[469667]: Disconnected from invalid user nikola 202.70.82.95 port 51142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-05 23:15:50 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:48357: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.106.246
country_id: 6252001
description:
2025-11-05 23:16:04 dovecot_login authenticator failed for ([134.22.106.246]) [134.22.106.246]:52734: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:16:32 host2 sshd[471456]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.9.75.204
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.9.75.204 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Nov  5 23:18:26 host2 sshd[473507]: Disconnected from invalid user jramirez 202.152.201.166 port 54944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:18:42 host2 sshd[473921]: Disconnected from invalid user ubuntu 198.98.56.205 port 60304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov  5 23:19:52 host2 sshd[475103]: Disconnected from invalid user rocky 198.98.56.205 port 44308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.195.226.17
country_id: 290557
description:
Nov  5 23:21:27 host2 sshd[476837]: Disconnected from invalid user jhernandez 5.195.226.17 port 19800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  5 23:20:49 host2 sshd[476182]: Disconnected from invalid user user 2.57.121.25 port 52981 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.195.226.17
country_id: 290557
description:
Nov  5 23:22:51 host2 sshd[478228]: Disconnected from invalid user dev 5.195.226.17 port 52740 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:24:58 host2 sshd[480203]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov  5 23:26:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nPvDqdxC6IRKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov  5 23:26:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS: Connection closed, session=<A+QmrNxCXLpKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  5 23:34:26 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, session=<Ib1zx9xClqxChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  5 23:34:33 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, session=<nkrUx9xCiKNChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.74
country_id: 6252001
description:
Nov  5 23:36:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.74, lip=66.85.158.92, session=<1zp4z9xCXaJBMQFK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Nov  5 23:36:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS: Connection closed, session=<Wi8+0NxCDDxBMQFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-05 23:38:10 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:59678: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-05 23:38:31 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:53108: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-05 23:40:07 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:50242: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-05 23:40:30 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:59684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-11-05 23:42:06 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:55886: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Nov  5 23:43:10 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.91, TLS, session=<Jyit5txC2ujN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-05 23:43:17 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:43440: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:28 host2 pure-ftpd[499585]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:32 host2 pure-ftpd[499760]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-05 23:42:37 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:57250: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2025-11-05 23:42:41 dovecot_login authenticator failed for ([152.52.234.222]) [125.22.116.94]:38728: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  5 23:43:34 host2 pure-ftpd[499802]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov  5 23:44:33 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<TBak69xCPo6s7OTF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.57
country_id: 6252001
description:
Nov  5 23:47:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.57, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CVzJ9txCE5NBMQE5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov  5 23:47:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nCfd99xC0ipBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  5 23:51:10 host2 sshd[508066]: Disconnected from invalid user prod 186.121.205.29 port 57604 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:50:53 host2 sshd[507771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  5 23:55:59 host2 sshd[514530]: Disconnected from invalid user utente 103.114.147.217 port 55012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  5 23:56:22 host2 sshd[514959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov  5 23:58:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XQOzHN1CLK+4aff+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  5 23:58:28 host2 sshd[517106]: Disconnected from invalid user sammy 181.188.159.138 port 47742 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov  5 23:58:39 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<scsHHt1Col64aff+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  5 23:58:53 host2 sshd[517607]: Disconnected from invalid user ubuntu 103.114.147.217 port 42250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:00:15 host2 sshd[519160]: Disconnected from invalid user coco 103.114.147.217 port 52220 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.155.142.194
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 105.155.142.194 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.83
country_id: 3175395
description:
Nov  6 00:00:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.208.189.83, lip=66.85.158.91, TLS, session=<m3A1Jd1CFd+50L1T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.17
country_id: 3865483
description:
Nov  6 00:01:35 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<info>, method=PLAIN, rip=190.181.90.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sYzIJt1COKa+tVoR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.64.32.144
country_id: 953987
description:
Nov  6 00:01:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=102.64.32.144, lip=66.85.158.91, TLS, session=<zHvQKN1C4N9mQCCQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  6 00:03:06 host2 sshd[522602]: Disconnected from invalid user sysadmin 186.121.205.29 port 56368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-06 00:04:11 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:52089: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.254.199
country_id: 1252634
description:
2025-11-06 00:04:35 dovecot_login authenticator failed for ([103.127.254.199]) [103.127.254.199]:41224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-06 00:04:48 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:46068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-06 00:04:48 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:54088: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-06 00:05:02 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:57096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:05:46 host2 sshd[526068]: Disconnected from invalid user gerrit 103.114.147.217 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov  6 00:07:09 host2 sshd[527602]: Disconnected from invalid user wangxin 103.114.147.217 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.121.205.29
country_id: 3923057
description:
Nov  6 00:10:45 host2 sshd[531220]: Disconnected from invalid user emma 186.121.205.29 port 54234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-06 00:11:25 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (taric) [68.60.77.128]:52780: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-11-06 00:19:00 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (pstees) [76.97.155.25]:35576: 535 Incorrect authentication data (set_id=news@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:20:28 host2 sshd[540673]: Disconnected from invalid user jlin 175.139.200.245 port 39497 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.214.41
country_id: 2921044
description:
Nov  6 00:19:34 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=164.90.214.41, lip=66.85.158.92, session=<WqXZaN1CkuakWtYp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:22:09 host2 sshd[542329]: Disconnected from invalid user VPN 175.139.200.245 port 55757 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-06 00:22:41 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (chiroarcer) [73.145.107.251]:34316: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:23:46 host2 sshd[543880]: Disconnected from invalid user ubuntu 175.139.200.245 port 43784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.139.200.245
country_id: 1733045
description:
Nov  6 00:25:20 host2 sshd[545589]: Disconnected from invalid user backuper 175.139.200.245 port 60044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 00:25:52 host2 sshd[546084]: Disconnected from invalid user elisha 62.60.131.157 port 19211 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.116.106.9
country_id: 798544
description:
Nov  6 00:26:40 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=195.116.106.9, lip=66.85.158.91, TLS, session=<vVM6gd1C+wrDdGoJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.236
country_id: 3175395
description:
Nov  6 00:26:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.189.236, lip=66.85.158.91, TLS, session=<CvRWgt1CJ6W50L3s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  6 00:26:32 host2 sshd[546735]: Disconnected from invalid user kbe 181.188.159.138 port 53358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 00:27:58 host2 sshd[548040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:29:41 host2 sshd[549751]: Disconnected from invalid user admin 152.32.201.226 port 43658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:31:03 host2 sshd[551393]: Disconnected from invalid user dev 152.32.201.226 port 20888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-06 00:32:26 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:35054: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:32:30 host2 sshd[552657]: Disconnected from invalid user arif 152.32.201.226 port 53126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-06 00:32:37 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:38504: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.159.138
country_id: 3923057
description:
Nov  6 00:34:13 host2 sshd[554290]: Disconnected from invalid user mattermost 181.188.159.138 port 37052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-06 00:34:21 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:35758: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.81.170.119
country_id: 4566966
description:
2025-11-06 00:34:30 dovecot_login authenticator failed for ([208.81.170.119]) [208.81.170.119]:13069: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov  6 00:35:23 host2 sshd[555801]: Disconnected from invalid user cacti 152.32.201.226 port 62596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:34:36 host2 sshd[554806]: Disconnected from invalid user oracle 189.8.108.156 port 59166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-06 00:34:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:3556: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-06 00:34:49 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:59082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-06 00:34:54 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:35027: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
country_id: 99237
description:
2025-11-06 00:35:07 dovecot_login authenticator failed for ([65.20.204.164]) [65.20.204.164]:50427: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:35:59 host2 sshd[556254]: Disconnected from invalid user pruebas 188.166.232.44 port 38006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:36:17 host2 sshd[556605]: Disconnected from invalid user ftpuser 189.8.108.156 port 56424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:39:19 host2 sshd[559681]: Disconnected from invalid user oracle 188.166.232.44 port 45664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:39:28 host2 sshd[559743]: Disconnected from invalid user bitnami 189.8.108.156 port 60880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:40:09 host2 sshd[560744]: Disconnected from invalid user dev 34.142.110.144 port 36744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.210
country_id: 6252001
description:
Nov  6 00:39:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</HI2sd1C9NbN0h/S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.232.44
country_id: 1880251
description:
Nov  6 00:42:34 host2 sshd[562845]: Disconnected from invalid user ftpuser 188.166.232.44 port 53306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov  6 00:42:57 host2 sshd[563220]: Disconnected from invalid user alf 189.8.108.156 port 58762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-06 00:45:01 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:45962: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-11-06 00:45:13 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:34809: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Nov  6 00:45:53 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.49, lip=66.85.158.91, session=<XQH3xt1CauWTuYQx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-06 00:49:02 dovecot_plain authenticator failed for (buselymet) [87.200.171.25]:49010: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-06 00:49:07 dovecot_plain authenticator failed for (totary) [65.20.143.159]:58120: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:50:08 host2 sshd[570941]: Disconnected from invalid user retag 34.142.110.144 port 36486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:51:14 host2 sshd[572171]: Disconnected from invalid user student4 34.142.110.144 port 36774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov  6 00:52:24 host2 sshd[573295]: Disconnected from invalid user dockeruser 34.142.110.144 port 37064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-06 00:59:20 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:55074: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-11-06 00:59:30 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:42267: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-06 01:04:11 dovecot_login authenticator failed for (nsg-static-121.34.76.182-airtel.com) [182.78.93.170]:47878: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-06 01:04:23 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:46639: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-11-06 01:04:22 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:34944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-06 01:03:59 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:50370: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-11-06 01:04:41 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:59460: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-06 01:04:55 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:56272: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:07:48 host2 sshd[590972]: Disconnected from invalid user ubuntu 128.199.157.145 port 46984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:09:08 host2 sshd[592266]: Disconnected from invalid user lch 128.199.157.145 port 47440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov  6 01:10:24 host2 sshd[593664]: Disconnected from invalid user admin 128.199.157.145 port 47898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-06 01:13:00 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:43894: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-11-06 01:13:13 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:36782: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.24
country_id: 6252001
description:
Nov  6 01:23:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.233.112.24, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sTLATt5Cir2H6XAY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.221
country_id: 6252001
description:
Nov  6 01:30:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nt3gZt5CLL4UQGnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 01:31:08 host2 sshd[614153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-06 01:35:33 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:46400: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-06 01:35:47 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:55120: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Nov  6 01:37:55 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.91, session=<nAkGgd5CJDms7OTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 01:41:46 host2 sshd[624689]: Disconnected from invalid user moshe 62.60.131.157 port 45689 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 01:46:46 host2 sshd[630179]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-11-06 01:47:01 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (priant) [24.23.125.83]:37380: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Nov  6 01:54:02 host2 kernel: update_imunify[637646]: segfault at ffffffffff17e041 ip 00007fa69eb39a7d sp 00007fff2c27fea8 error 5 in memfd:upX (deleted)[7fa69eb39000+1000]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  6 01:55:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<+wjjwN5CuNdChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.150
country_id: 1269750
description:
2025-11-06 01:56:44 dovecot_login authenticator failed for (nsg-corporate-193.168.185.122.airtel.in) [125.19.163.150]:33080: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-06 01:57:22 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:48590: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-06 01:58:07 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:39042: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-06 01:58:41 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:52730: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-06 01:59:20 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:39391: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-06 01:59:37 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:60152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:02:39 host2 sshd[647256]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.136
country_id: 6252001
description:
Nov  6 02:06:07 host2 pure-ftpd[651505]: (?@40.124.175.136) [INFO] New connection from 40.124.175.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-06 02:11:00 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:56309: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 02:11:35 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:49408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Nov  6 02:14:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.206.49, lip=66.85.158.92, session=<RjhcBd9CDsKUcc4x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.221
country_id: 3469034
description:
Nov  6 02:17:05 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.128.221, lip=66.85.158.91, TLS, session=<dC7zC99C1qa/NYDd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.48
country_id: 953987
description:
Nov  6 02:16:42 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.129.63.48, lip=66.85.158.91, TLS, session=<UH6bCt9CGJVmgT8w>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-06 02:20:13 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:52301: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-06 02:20:34 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:56000: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:24:04 host2 sshd[670219]: Disconnected from invalid user ubuntu 198.98.57.141 port 43822 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:25:13 host2 sshd[671290]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-06 02:25:24 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32516: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:26:04 host2 sshd[672276]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-06 02:26:06 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:39050: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-06 02:26:17 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:50985: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.68
country_id: 6252001
description:
Nov  6 02:26:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.68, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+nARLt9CE9nG6xhE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-06 02:26:26 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:34011: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:25:47 host2 sshd[672069]: Disconnected from invalid user fox 198.98.57.141 port 45564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov  6 02:30:37 host2 sshd[676960]: Disconnected from invalid user ubuntu 198.98.57.141 port 50784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.177.31.66
country_id: 3017382
description:
Nov  6 02:30:40 host2 sshd[676997]: Disconnected from invalid user ubuntu 164.177.31.66 port 33936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 02:39:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49578: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.161.146
country_id: 1269750
description:
2025-11-06 02:42:03 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.161.146]:39954: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-06 02:42:27 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:48048: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  6 02:42:54 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, TLS, session=<VkJ0ad9CFL6UcdUX>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.109
country_id: 2635167
description:
Nov  6 02:43:20 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.109, lip=66.85.158.91, TLS, session=<gEj9at9CWcdX7LBt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Nov  6 02:43:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bWJGa99C4+m594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Nov  6 02:43:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8txBbd9CZbFX7LBo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.95
country_id: 2635167
description:
Nov  6 02:44:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.95, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=</1I9b99C4ZFX7LBf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.88
country_id: 2635167
description:
Nov  6 02:45:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.88, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ibg4cd9Cc9xX7LBY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov  6 02:46:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<frUtdd9CAc6594lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Nov  6 02:45:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<uEg0c99CL5FX7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Nov  6 02:46:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4egqd99CvYFX7LBd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.79
country_id: 2635167
description:
Nov  6 02:47:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.79, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<53ooed9CY7ZX7LBP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.84
country_id: 2635167
description:
Nov  6 02:48:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<yF0dfd9CI8ZX7LBU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.100
country_id: 2635167
description:
Nov  6 02:47:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<GO0he99C4a9X7LBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.28
country_id: 798544
description:
Nov  6 02:50:18 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=84.234.125.28, lip=66.85.158.91, TLS, session=<wDHogt9ClZhU6n0c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.135
country_id: 2300660
description:
Nov  6 02:50:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.11.135, lip=66.85.158.91, TLS, session=<CH0lhN9CoNgpiwuH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 02:55:11 host2 pure-ftpd[703242]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 02:55:19 host2 pure-ftpd[703453]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Nov  6 02:57:15 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.236, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NpO/nN9C6d7G6xjs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 02:59:00 host2 sshd[707387]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 03:05:43 host2 sshd[715076]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.117
country_id: 6252001
description:
Nov  6 03:11:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.117, lip=66.85.158.92, TLS, session=<gYFjz99CRPbG6xh1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 03:12:13 host2 sshd[721908]: Disconnected from invalid user cali 62.60.131.157 port 46911 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-06 03:19:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ingly) [87.103.126.54]:6614: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Nov  6 03:20:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.206.49, lip=66.85.158.91, session=<cnf57t9CwKaUcc4x>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.211
country_id: 6252001
description:
Nov  6 03:20:54 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.211, lip=66.85.158.92, session=<I2ZS8d9CAOHN0h/T>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov  6 03:22:50 host2 pure-ftpd[733711]: (?@205.210.31.241) [INFO] New connection from 205.210.31.241


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.126
country_id: 2635167
description:
Nov  6 03:24:26 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.126, lip=66.85.158.91, session=<eHD7/d9CMvgjy9J+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:31:18 host2 sshd[743353]: Disconnected from invalid user gameserver 20.102.70.34 port 41084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 03:33:15 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:8217: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-06 03:33:28 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:37449: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Nov  6 03:34:28 host2 sshd[746968]: Disconnected from invalid user work 182.18.139.237 port 57460 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 03:37:10 host2 sshd[750251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:38:05 host2 sshd[751339]: Disconnected from invalid user s1 20.102.70.34 port 52110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:39:29 host2 sshd[752740]: Disconnected from invalid user rmartinez 20.102.70.34 port 53486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.70.34
country_id: 6252001
description:
Nov  6 03:40:50 host2 sshd[754416]: Disconnected from invalid user sistemas 20.102.70.34 port 54834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:43:16 host2 sshd[756761]: Disconnected from invalid user natali 185.50.38.231 port 56386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:44:22 host2 sshd[757822]: Disconnected from invalid user user 135.235.138.43 port 50890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:44:18 host2 sshd[757767]: Disconnected from invalid user sammy 152.32.172.146 port 38666 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:46:31 host2 sshd[761409]: Disconnected from invalid user jenkins 185.50.38.231 port 44814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:46:11 host2 sshd[760905]: Disconnected from invalid user montse 152.32.172.146 port 45960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:47:32 host2 sshd[762560]: Disconnected from invalid user dms 135.235.138.43 port 60664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov  6 03:47:43 host2 sshd[762759]: Disconnected from invalid user caja01 185.50.38.231 port 33980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 03:47:46 host2 sshd[762853]: Disconnected from invalid user produccion 103.195.4.162 port 52032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:50:42 host2 sshd[766773]: Disconnected from invalid user natali 135.235.138.43 port 34620 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.195
country_id: 6252001
description:
Nov  6 03:51:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lxkbXeBCW83N0h/D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:51:20 host2 sshd[767605]: Disconnected from invalid user mamad 152.32.172.146 port 35274 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.235.138.43
country_id: 1269750
description:
Nov  6 03:52:26 host2 sshd[768928]: Disconnected from invalid user rooter 135.235.138.43 port 37932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov  6 03:52:39 host2 sshd[769246]: Disconnected from invalid user produccion 152.32.172.146 port 35832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 03:56:20 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:33377: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.85
country_id: 6252001
description:
Nov  6 03:56:34 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.155.85, lip=66.85.158.92, session=<EbfrcOBCaO3HLZtV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-06 03:55:38 dovecot_login authenticator failed for ([37.57.69.227]) [37.57.69.227]:49479: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2025-11-06 03:55:32 dovecot_login authenticator failed for (17.54.gonzagatelecom.com.br) [177.128.54.17]:40652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-06 03:55:49 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:46918: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-06 03:56:04 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 03:58:18 host2 sshd[777946]: Disconnected from invalid user li 154.91.170.77 port 41278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 03:58:28 host2 sshd[778190]: Disconnected from invalid user it 103.195.4.162 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 03:58:56 host2 sshd[778733]: Disconnected from invalid user cps 20.253.214.172 port 38340 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.117
country_id: 6252001
description:
Nov  6 04:00:24 host2 pure-ftpd[780541]: (?@195.184.76.117) [INFO] New connection from 195.184.76.117


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:02:09 host2 sshd[782696]: Disconnected from invalid user ftpuser 103.174.215.18 port 60492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.195.4.162
country_id: 1819730
description:
Nov  6 04:02:45 host2 sshd[783582]: Disconnected from invalid user koko 103.195.4.162 port 37106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 04:02:52 host2 sshd[783689]: Disconnected from invalid user steam 154.91.170.77 port 59152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 04:04:19 host2 sshd[786078]: Disconnected from invalid user ahmad 20.253.214.172 port 60718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:03:40 host2 sshd[785163]: Disconnected from invalid user ubuntu 103.174.215.18 port 41860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov  6 04:05:56 host2 sshd[788078]: Disconnected from invalid user mahendra 20.253.214.172 port 43546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:07:49 host2 sshd[790398]: Disconnected from invalid user fff 103.174.215.18 port 39792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.77
country_id: 241170
description:
Nov  6 04:08:22 host2 sshd[791080]: Disconnected from invalid user jake 154.91.170.77 port 52156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-06 04:09:07 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:38582: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.215.18
country_id: 1210997
description:
Nov  6 04:09:10 host2 sshd[792062]: Disconnected from invalid user dmp 103.174.215.18 port 48402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-06 04:09:36 dovecot_login authenticator failed for ([65.20.155.223]) [65.20.155.223]:48706: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:11:05 host2 sshd[794797]: Disconnected from invalid user manuel 103.49.238.251 port 43240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:14:07 host2 sshd[798675]: Disconnected from invalid user victor 103.49.238.251 port 60320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:15:44 host2 sshd[801138]: Disconnected from invalid user sepehr 103.49.238.251 port 49420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov  6 04:17:22 host2 sshd[803753]: Disconnected from invalid user life 103.49.238.251 port 57950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.162
country_id: 1733045
description:
2025-11-06 04:20:19 dovecot_login authenticator failed for ([49.124.154.162]) [49.124.154.162]:36582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-06 04:20:31 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:41421: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.98
country_id: 226074
description:
Nov  6 04:21:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=196.0.107.98, lip=66.85.158.91, TLS, session=<eU6kyOBC8+3EAGti>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.120
country_id: 3175395
description:
Nov  6 04:21:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.120, lip=66.85.158.91, TLS, session=<s2/dyeBC37erFut4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov  6 04:35:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.91, session=<xHxu+uBCjJyUcdUX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-11-06 04:36:50 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (cater) [73.137.7.97]:41556: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 04:39:55 host2 sshd[832826]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 04:44:16 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, TLS, session=<7DmCG+FCHuMz3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.107
country_id: 6252001
description:
Nov  6 04:45:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.107, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AciiIeFCCNbN0h9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov  6 04:52:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=86.54.31.32, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YdzoOOFC0qhWNh8g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov  6 04:52:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<sMwjOuFCvsqUcd0c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov  6 04:52:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=653) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.91, TLS: read(size=653) failed: Connection reset by peer, session=<nNsjOeFCmrJWNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-06 04:55:27 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:49286: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 04:55:28 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:6558: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-06 04:55:27 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:36832: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-06 04:55:49 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:33518: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-06 04:55:54 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:37730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-06 04:55:33 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:33407: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 04:55:50 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54951: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-06 05:03:39 dovecot_plain authenticator failed for (madiospier) [102.53.15.17]:44022: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 05:11:36 host2 sshd[862099]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.213
country_id: 2300660
description:
Nov  6 05:11:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=41.139.37.213, lip=66.85.158.91, TLS, session=<d+EkfOFC5aEpiyXV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.130
country_id: 3865483
description:
Nov  6 05:11:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.124.218.130, lip=66.85.158.91, TLS, session=<889ffeFC7Jy6fNqC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-06 05:13:52 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:30599: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-06 05:13:52 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:47434: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-06 05:14:14 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:32266: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-06 05:14:36 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:33328: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-06 05:33:59 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:50876: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-06 05:34:28 dovecot_login authenticator failed for ([50.235.31.47]) [50.235.31.47]:56146: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-06 05:34:40 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:44697: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-06 05:34:52 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:34708: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:35:15 host2 sshd[883604]: Disconnected from invalid user unity 212.19.117.204 port 43223 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:37:44 host2 sshd[885891]: Disconnected from invalid user install 212.19.117.204 port 36701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:37:24 host2 sshd[885626]: Disconnected from invalid user ry 27.254.185.64 port 17368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.19.117.204
country_id: 3175395
description:
Nov  6 05:38:58 host2 sshd[886878]: Disconnected from invalid user erp 212.19.117.204 port 51274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:42:36 host2 sshd[890120]: Disconnected from invalid user andi 27.254.185.64 port 9066 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov  6 05:42:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1RGt7OFCpoFChJmA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Nov  6 05:44:11 host2 sshd[891436]: Disconnected from invalid user raj 27.254.185.64 port 34882 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.115
country_id: 3017382
description:
Nov  6 05:50:18 host2 pure-ftpd[897463]: (?@91.196.152.115) [INFO] New connection from 91.196.152.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-06 05:53:54 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:49712: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-11-06 05:54:39 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:65016: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-06 05:58:34 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:60198: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-06 05:58:56 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:41174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-06 06:05:25 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (burry) [73.224.171.101]:50380: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.208.133.247
country_id: 6252001
description:
Nov  6 06:10:34 host2 sshd[916130]: Disconnected from invalid user user2 74.208.133.247 port 51198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 06:11:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59590: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:13:09 host2 sshd[918425]: Disconnected from invalid user kiran 166.140.93.55 port 53462 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:14:42 host2 sshd[919685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.133.247
country_id: 6252001
description:
Nov  6 06:18:45 host2 sshd[923658]: Disconnected from invalid user admin1 74.208.133.247 port 40440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:19:11 host2 sshd[924030]: Disconnected from invalid user postgres 166.140.93.55 port 60204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.140.93.55
country_id: 6252001
description:
Nov  6 06:20:39 host2 sshd[925293]: Disconnected from invalid user runner 166.140.93.55 port 33640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 06:21:23 host2 sshd[925959]: Disconnected from invalid user user 2.57.121.25 port 34348 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:25:52 host2 sshd[929736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-06 06:31:21 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (drifachen) [98.227.25.115]:32858: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:34:54 host2 sshd[937883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-06 06:34:46 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:49922: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-11-06 06:34:48 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:52593: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-06 06:34:56 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:57741: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-06 06:34:21 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:58260: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-06 06:34:24 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:60288: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov  6 06:40:50 host2 sshd[944015]: Disconnected from invalid user yuki 167.172.43.167 port 57026 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:46:09 host2 sshd[949353]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov  6 06:49:31 host2 sshd[952150]: Disconnected from invalid user wyy 167.172.43.167 port 33550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:53:26 host2 sshd[955932]: Disconnected from invalid user sysadmin 103.179.218.243 port 51392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:54:20 host2 sshd[957046]: Disconnected from invalid user jupyter 103.179.218.243 port 51474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.225
country_id: 3469034
description:
Nov  6 06:54:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=191.53.130.225, lip=66.85.158.91, TLS, session=<nbyc7OJC+Na/NYLh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.95
country_id: 3865483
description:
Nov  6 06:55:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.1.224.95, lip=66.85.158.91, TLS, session=</xn+7eJCoZm6AeBf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.218.243
country_id: 1643084
description:
Nov  6 06:55:03 host2 sshd[957843]: Disconnected from invalid user leonardo 103.179.218.243 port 51546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 06:57:07 host2 sshd[959867]: Disconnected from invalid user omer 103.172.112.192 port 33912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov  6 06:56:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<GtAF9OJC2uOnXpIx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 06:57:14 host2 sshd[959940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 06:59:45 host2 sshd[961958]: Disconnected from invalid user azureuser 151.5.112.39 port 48654 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:01:05 host2 sshd[963359]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:01:35 host2 sshd[963936]: Disconnected from invalid user minni 103.172.112.192 port 52064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 07:01:39 host2 sshd[964021]: Disconnected from invalid user jolie 62.60.131.157 port 51243 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:01:46 host2 sshd[964117]: Disconnected from invalid user omm 103.143.72.165 port 34764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-06 07:01:53 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (humpsal) [24.127.53.61]:52464: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:02:39 host2 sshd[964977]: Disconnected from invalid user laci 186.96.151.198 port 40696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 07:04:11 host2 sshd[966641]: Disconnected from invalid user gcs 151.5.112.39 port 56456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:03:12 host2 sshd[965830]: Disconnected from invalid user postgresql 103.172.112.192 port 57776 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 151.5.112.39
country_id: 3175395
description:
Nov  6 07:03:23 host2 sshd[966019]: Received disconnect from 151.5.112.39 port 45740:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:06:16 host2 sshd[968652]: Disconnected from invalid user roberta 186.96.151.198 port 42844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:06:52 host2 sshd[969341]: Disconnected from invalid user antonio 58.147.171.11 port 32652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:08:18 host2 sshd[970603]: Disconnected from invalid user arkserver 58.147.171.11 port 61730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov  6 07:09:28 host2 sshd[971620]: Disconnected from invalid user prakash 103.172.112.192 port 35102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov  6 07:10:01 host2 sshd[972099]: Disconnected from invalid user ubuntu 186.96.151.198 port 44996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov  6 07:11:10 host2 sshd[973286]: Disconnected from invalid user admin 58.147.171.11 port 63372 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:11:31 host2 sshd[973721]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:13:39 host2 sshd[975819]: Disconnected from invalid user fivem 103.143.72.165 port 58664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.72.165
country_id: 1819730
description:
Nov  6 07:16:59 host2 sshd[978817]: Disconnected from invalid user crypto 103.143.72.165 port 60502 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:19:21 host2 sshd[981017]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-06 07:19:27 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:37524: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-11-06 07:19:51 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:53446: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.126
country_id: 2264397
description:
Nov  6 07:24:40 host2 pure-ftpd[985807]: (?@45.156.129.126) [INFO] New connection from 45.156.129.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-06 07:27:14 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:55050: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-06 07:27:33 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:35254: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.2.112
country_id: 1269750
description:
2025-11-06 07:28:24 dovecot_login authenticator failed for ([103.140.2.112]) [103.140.2.112]:36969: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-06 07:28:40 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:52371: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-06 07:32:15 dovecot_plain authenticator failed for (antifinis) [65.20.205.197]:33741: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.237.191
country_id: 3508796
description:
Nov  6 07:40:54 host2 sshd[1001005]: Disconnected from invalid user vhserver 190.167.237.191 port 49256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov  6 07:43:26 host2 sshd[1003383]: Disconnected from invalid user rohit 190.167.237.191 port 34806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 07:43:36 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:51890: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.149
country_id: 690791
description:
Nov  6 07:43:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=37.221.147.149, lip=66.85.158.91, TLS, session=<19glnONC15sl3ZOV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.97
country_id: 798544
description:
Nov  6 07:44:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=78.11.95.97, lip=66.85.158.91, TLS, session=<tRk2neNCL+tOC19h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 07:44:10 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:55746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 07:49:17 host2 sshd[1009503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-06 07:57:03 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52929: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-06 07:57:25 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:55090: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-06 07:57:24 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:49631: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-06 07:57:42 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:34920: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-06 08:10:41 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:49732: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-06 08:10:24 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41607: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2025-11-06 08:14:23 dovecot_login authenticator failed for (abts-tn-static-181.6.185.136.airtelbroadband.in) [136.185.6.181]:44465: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.237.243.62
country_id: 192950
description:
2025-11-06 08:14:08 dovecot_login authenticator failed for (197.237.243.62.wananchi.com) [197.237.243.62]:52765: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 08:16:36 host2 sshd[1037498]: Disconnected from invalid user asa 62.60.131.157 port 27029 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.40
country_id: 6252001
description:
Nov  6 08:19:44 host2 pure-ftpd[1040398]: (?@198.235.24.40) [INFO] New connection from 198.235.24.40


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 08:20:46 host2 sshd[1041426]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.17
country_id: 3469034
description:
Nov  6 08:28:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=187.85.104.17, lip=66.85.158.91, TLS, session=<riMtPeRCyry7VWgR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.237.119
country_id: 99237
description:
Nov  6 08:29:03 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.237.119, lip=66.85.158.91, TLS, session=<mXVXPuRCfYtBFO13>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 08:40:39 host2 sshd[1060470]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-06 08:44:11 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (assly) [68.38.201.238]:45446: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-06 08:46:48 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:39380: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-06 08:46:07 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:47752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.171.97
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.171.97 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User cloudtourssrilan has their account suspended. Login blocked.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Nov  6 09:01:43 host2 sshd[1081526]: Disconnected from invalid user odoo11 202.79.29.108 port 60010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Nov  6 09:04:43 host2 sshd[1084537]: Disconnected from invalid user ec2-user 202.79.29.108 port 34834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-11-06 09:06:28 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net (ovuloic) [73.45.216.101]:40814: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.241.103
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 74.105.241.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:10:37 host2 sshd[1090698]: Disconnected from invalid user odoo11 45.78.193.79 port 60154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 09:21:16 host2 sshd[1101224]: Disconnected from invalid user bernard 62.60.131.157 port 38774 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 09:21:49 host2 sshd[1101853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 09:23:53 host2 sshd[1103858]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:25:45 host2 sshd[1105725]: Disconnected from invalid user user 45.78.193.79 port 55030 [preauth]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.134.169.106
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.169.106 - cloudtourssrilan "POST /cpsess4606104971/json-api/cpanel HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [101.2.176.13] != Current IP Address [112.134.169.106]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.79
country_id: 1880251
description:
Nov  6 09:33:24 host2 sshd[1112686]: Disconnected from invalid user max 45.78.193.79 port 59836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 09:39:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59044: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.10
country_id: 6252001
description:
Nov  6 09:41:04 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.10, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IWL0QOVCqdnG6xgK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:04 host2 pure-ftpd[1123193]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:07 host2 pure-ftpd[1123269]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.190.57
country_id: 6251999
description:
Nov  6 09:44:09 host2 pure-ftpd[1123299]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov  6 09:48:17 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.204, lip=66.85.158.92, session=<JfW6WuVCILmUcdbM>


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 112.134.169.106
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 112.134.169.106 NEW cloudtourssrilan:Yx6p4hokCT7y3K_t address=112.134.169.106,app=cpaneld,creator=cloudtourssrilan,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-06 09:51:28 dovecot_plain authenticator failed for (ditubil) [65.20.147.45]:50336: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2025-11-06 09:59:14 dovecot_login authenticator failed for (190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:37760: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-06 09:59:43 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:57807: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.78
country_id: 6252001
description:
Nov  6 10:00:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.78, lip=66.85.158.91, TLS, session=<goBIheVCQsdC5DVO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.227
country_id: 798544
description:
Nov  6 10:02:24 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=78.11.95.227, lip=66.85.158.91, TLS, session=<T9U3jOVCtrpOC1/j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.229
country_id: 3175395
description:
Nov  6 10:02:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.188.229, lip=66.85.158.91, TLS, session=<VjhJjeVCKJ+50Lzl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-06 10:05:47 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:43110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Nov  6 10:05:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<px1pmeVCUKstT3OG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
country_id: 1269750
description:
2025-11-06 10:05:17 dovecot_login authenticator failed for ([49.206.244.235]) [49.206.241.22]:36832: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:06:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4Io5neVCo9Ijy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:07:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<78dWoOVCrOsjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  6 10:08:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OolDpOVCLInUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:08:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<HCTLoeVCqOYjy9JO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 10:09:15 host2 sshd[1150902]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-06 10:10:32 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:60170: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-06 10:10:56 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:36020: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.204.7
country_id: 6251999
description:
Nov  6 10:13:06 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=68.183.204.7, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IRl1s+VCstlEt8wH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.204.7
country_id: 6251999
description:
Nov  6 10:13:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=68.183.204.7, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<C8aGs+VC9tlEt8wH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:14:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<kujituVCNuQjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:15:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<rvd8uuVCEvEjy9JO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.78
country_id: 2635167
description:
Nov  6 10:15:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.78, lip=66.85.158.91, TLS, session=<pNa+uuVCgOgjy9JO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.177.19
country_id: 2782113
description:
Nov  6 10:15:57 host2 pure-ftpd[1157507]: (?@185.242.177.19) [INFO] New connection from 185.242.177.19


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.177.19
country_id: 2782113
description:
Nov  6 10:15:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.177.19, lip=66.85.158.91, session=<Bf6xveVC6K258rET>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-06 10:22:20 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:47578: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-06 10:22:37 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:34906: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-06 10:24:59 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:56117: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.74
country_id: 3865483
description:
Nov  6 10:25:58 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=181.225.195.74, lip=66.85.158.91, TLS, session=<9FZc4OVCOrS14cNK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-06 10:25:26 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:51402: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.230
country_id: 953987
description:
Nov  6 10:25:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.64.42.230, lip=66.85.158.91, TLS, session=<rJUQ3+VCqpZmQCrm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-06 10:30:42 dovecot_plain authenticator failed for (euling) [46.8.245.34]:44102: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov  6 10:32:20 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.91, TLS, session=<mPZB+OVCcEms7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-06 10:35:46 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:54766: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-06 10:36:10 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:48142: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 10:42:43 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57212: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-06 10:43:17 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:45784: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 10:54:11 host2 sshd[1197462]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:13:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+IbkiuZCgPKTuYSV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:14:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</v7XjeZCoPWTuYSV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-06 11:14:47 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:51581: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-06 11:15:00 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:41759: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:16:37 host2 sshd[1221460]: Disconnected from invalid user localhost 45.81.23.80 port 50472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:18:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS, session=<rc/9nOZCBPOTuYSV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:19:48 host2 sshd[1224771]: Disconnected from invalid user public 45.81.23.80 port 57790 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.149
country_id: 6252001
description:
Nov  6 11:19:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.149, lip=66.85.158.92, TLS, session=<OeKQouZCHumTuYSV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.80
country_id: 2750405
description:
Nov  6 11:20:55 host2 sshd[1225883]: Disconnected from invalid user panel 45.81.23.80 port 57016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-11-06 11:24:16 dovecot_plain authenticator failed for (buming) [88.207.210.23]:59350: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:28:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<qXc7wOZCxIkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:29:41 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nxBixeZCDpMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:30:28 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<i28nyOZCss4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:31:42 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<EmOUzOZCnLgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:33:04 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<UXp/0eZCirADhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:33:52 host2 dovecot[3154217]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<vapa1OZC1qoDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 11:34:34 host2 sshd[1239794]: Disconnected from invalid user user 2.57.121.25 port 34610 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov  6 11:34:39 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<Wj8c1+ZC3runXpI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:35:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<XH2V2OZChI8DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:35:19 host2 dovecot[3154217]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ToOG2eZCLM8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-06 11:36:15 dovecot_plain authenticator failed for (forip) [65.20.147.45]:49037: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  6 11:36:39 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<rEVQ3uZCYqsDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.94
country_id: 1880251
description:
Nov  6 11:40:03 host2 sshd[1245319]: Disconnected from invalid user ftp_client 101.47.162.94 port 35972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.15
country_id: 690791
description:
Nov  6 11:42:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=195.64.244.15, lip=66.85.158.91, TLS, session=<WhBW8+ZCDYnDQPQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.42
country_id: 3175395
description:
Nov  6 11:43:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.171.42, lip=66.85.158.91, TLS, session=<Tzts9OZCOb65D6sq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-06 11:46:25 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:39307: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-06 11:47:21 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:33348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.61.163
country_id: 1269750
description:
2025-11-06 11:54:55 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.61.163]:2212: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-11-06 11:55:16 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:50983: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-06 11:58:09 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:45101: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-06 11:58:28 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:33926: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:04:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, session=<l5eUQOdCvJoz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:05:36 host2 sshd[1273013]: Disconnected from invalid user mailuser 103.84.119.130 port 40018 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:05:54 host2 pure-ftpd[1273349]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.222.152.150
country_id: 6251999
description:
Nov  6 12:05:59 host2 pure-ftpd[1273454]: (?@51.222.152.150) [INFO] New connection from 51.222.152.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-06 12:06:31 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:55346: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-06 12:07:28 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:44341: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.235.217
country_id: 2921044
description:
Nov  6 12:08:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.235.217, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<V9zKT+dC4c+kXOvZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.22.160
country_id: 2921044
description:
Nov  6 12:08:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.22.22.160, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zFDmUedC0q+lFhag>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:09:53 host2 sshd[1277371]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:09:18 host2 sshd[1276812]: Disconnected from invalid user ftptest 103.84.119.130 port 37734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:10:41 host2 sshd[1278388]: Disconnected from invalid user vps 103.84.119.130 port 43044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:11:31 host2 sshd[1279089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.119.130
country_id: 1643084
description:
Nov  6 12:12:02 host2 sshd[1279654]: Disconnected from invalid user billing 103.84.119.130 port 41122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov  6 12:13:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.248, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<To7GYOdC9MvG6xj4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-11-06 12:13:12 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:47898: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov  6 12:14:07 host2 sshd[1282205]: Disconnected from invalid user ts1 162.241.127.152 port 42026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.109.200.147
country_id: 130758
description:
Nov  6 12:16:09 host2 sshd[1284426]: Disconnected from invalid user artur 78.109.200.147 port 48642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-06 12:18:30 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:48720: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.140.231
country_id: 1168579
description:
2025-11-06 12:18:53 dovecot_login authenticator failed for ([103.139.140.231]) [103.139.140.231]:42619: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.233.247.114
country_id: 298795
description:
2025-11-06 12:18:59 dovecot_plain authenticator failed for ([89.116.164.85]) [185.233.247.114]:46496: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.108.213.123
country_id: 3469034
description:
2025-11-06 12:19:13 dovecot_plain authenticator failed for ([89.116.164.85]) [179.108.213.123]:56280: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.20.116.193
country_id: 3469034
description:
2025-11-06 12:19:28 dovecot_plain authenticator failed for ([89.116.164.85]) [187.20.116.193]:52234: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:19:39 host2 sshd[1288192]: Disconnected from invalid user user5 103.137.194.125 port 59912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov  6 12:19:42 host2 sshd[1288270]: Disconnected from invalid user artur 162.241.127.152 port 43680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:23:30 host2 sshd[1292501]: Disconnected from invalid user adminuser 47.180.114.229 port 58794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Nov  6 12:23:31 host2 sshd[1292499]: Disconnected from invalid user tol 78.109.200.147 port 35742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:24:37 host2 sshd[1293644]: Disconnected from invalid user miki 103.137.194.125 port 48574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:25:54 host2 sshd[1294912]: Disconnected from invalid user kapil 47.180.114.229 port 60878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:27:11 host2 sshd[1296304]: Disconnected from invalid user sftpuser 47.180.114.229 port 33696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.180.114.229
country_id: 6252001
description:
Nov  6 12:28:26 host2 sshd[1297407]: Disconnected from invalid user alf 47.180.114.229 port 34738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov  6 12:29:29 host2 sshd[1298335]: Disconnected from invalid user aiya 103.137.194.125 port 40230 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:29:43 host2 sshd[1298581]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.99.27.79
country_id: 1643084
description:
Nov  6 12:33:43 host2 sshd[1302657]: Invalid user info@idesignvector.com from 103.99.27.79 port 52350


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.99.27.79
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.99.27.79 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.48.61
country_id: 2921044
description:
Nov  6 12:37:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.71.48.61, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<G3cttudCYaOnRzA9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.29
country_id: 2921044
description:
Nov  6 12:37:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=139.59.136.29, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9GVKuOdC9kmLO4gd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Nov  6 12:37:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS, session=<yD+/uOdCtOmTuYRA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.48.61
country_id: 2921044
description:
Nov  6 12:37:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=167.71.48.61, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<d3SUtudClSunRzA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:45:24 host2 sshd[1314346]: Disconnected from invalid user vhserver 152.89.168.4 port 51902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:46:45 host2 sshd[1315482]: Disconnected from invalid user noreply 152.89.168.4 port 47150 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 12:48:04 host2 sshd[1316731]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-11-06 12:50:42 dovecot_login authenticator failed for (70-89-116.5-busname-wa.hfc.comcastbusiness.net) [70.89.116.5]:58105: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.89.168.4
country_id: 3175395
description:
Nov  6 12:51:47 host2 sshd[1320573]: Disconnected from invalid user developer 152.89.168.4 port 48064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-11-06 12:51:11 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:36278: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-06 12:51:43 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:2693: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 12:53:01 host2 sshd[1321857]: Disconnected from invalid user elp 45.138.159.230 port 59156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.154.74.33
country_id: 6252001
description:
2025-11-06 12:54:07 dovecot_plain authenticator failed for c-73-154-74-33.hsd1.wv.comcast.net ([89.116.164.85]) [73.154.74.33]:50048: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.82
country_id: 6252001
description:
Nov  6 13:01:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.82, lip=66.85.158.92, session=<T6NlDuhCaJKsynZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 13:02:29 host2 sshd[1331892]: Disconnected from invalid user darnell 62.60.131.157 port 26846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 13:02:31 host2 sshd[1331897]: Disconnected from invalid user sonarqube 45.138.159.230 port 45424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.159.230
country_id: 1512440
description:
Nov  6 13:05:08 host2 sshd[1334907]: Disconnected from invalid user admin 45.138.159.230 port 48848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov  6 13:05:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<GzOzHehCnMinXpI1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov  6 13:12:02 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.91, session=<9exqM+hC8M+l4z73>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 13:11:58 host2 sshd[1341339]: Disconnected from invalid user darnell 62.60.131.157 port 63979 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 13:15:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64237: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.206.110
country_id: 130758
description:
Nov  6 13:16:37 host2 sshd[1345626]: Disconnected from invalid user tempuser 85.133.206.110 port 42440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 13:16:55 host2 sshd[1345891]: Disconnected from invalid user user 2.57.121.25 port 30250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.206.110
country_id: 130758
description:
Nov  6 13:26:44 host2 sshd[1354585]: Disconnected from invalid user ftpuser 85.133.206.110 port 54978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2025-11-06 13:28:26 dovecot_login authenticator failed for ([49.124.148.186]) [49.124.148.186]:34642: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-06 13:27:56 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:41324: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.68.212
country_id: 6252001
description:
Nov  6 13:28:46 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=159.203.68.212, lip=66.85.158.92, TLS, session=<VWNDb+hC7oGfy0TU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 13:33:37 host2 sshd[1361224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.124
country_id: 3175395
description:
Nov  6 13:34:25 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.124, lip=66.85.158.91, TLS, session=<fO5zguhC4pW5D6l8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.213
country_id: 3865483
description:
Nov  6 13:34:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=181.191.223.213, lip=66.85.158.91, TLS, session=<wblHgehCNtC1v9/V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.222
country_id: 6252001
description:
Nov  6 13:37:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.124.222, lip=66.85.158.91, session=<X8UBj+hCwtQNWXze>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-06 13:38:06 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (denterp) [73.196.144.25]:46932: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-06 13:40:14 dovecot_plain authenticator failed for (cromeles) [65.20.251.71]:55549: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.195.83.210
country_id: 1269750
description:
Nov  6 13:44:46 host2 sshd[1371901]: Disconnected from invalid user user4 14.195.83.210 port 8259 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Nov  6 13:49:40 host2 sshd[1376824]: Disconnected from invalid user asterisk 14.195.83.210 port 29821 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-06 13:56:14 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:49388: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.160.146
country_id: 3469034
description:
2025-11-06 13:56:42 dovecot_login authenticator failed for ([191.59.160.146]) [191.59.160.146]:36400: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.134
country_id: 1269750
description:
Nov  6 14:02:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.18.166.134, lip=66.85.158.91, TLS, session=<EDm85ehCZ6FnEqaG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.78
country_id: 798544
description:
Nov  6 14:02:32 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.244.78, lip=66.85.158.91, TLS, session=<y4oA5+hCN7NtffRO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-06 14:04:58 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:39170: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-06 14:05:24 dovecot_login authenticator failed for ([125.20.249.192]) [27.123.113.10]:60060: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-06 14:05:42 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:35247: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-06 14:05:53 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:59000: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-06 14:08:02 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:40094: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-06 14:08:11 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:46554: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-06 14:08:28 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:34723: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-06 14:07:51 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:54612: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.2.4.105
country_id: 1819730
description:
Nov  6 14:09:10 host2 sshd[1399494]: Disconnected from invalid user ubuntu 20.2.4.105 port 49872 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.231
country_id: 6252001
description:
Nov  6 14:09:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KindAelCUtTG6xjn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:11:07 host2 sshd[1401898]: Disconnected from invalid user hadi 172.245.92.99 port 55778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:12:19 host2 sshd[1403028]: Disconnected from invalid user elasticsearch 172.245.92.99 port 42216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-06 14:12:34 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (pharauman) [98.40.101.10]:38322: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 14:15:32 host2 sshd[1406100]: Disconnected from invalid user izaiah 62.60.131.157 port 19359 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Nov  6 14:15:50 host2 sshd[1406402]: Disconnected from invalid user zhouhao 172.245.92.99 port 50212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov  6 14:18:05 host2 sshd[1408691]: Disconnected from invalid user amax 62.97.44.51 port 47362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:18:42 host2 sshd[1409373]: Disconnected from invalid user admin 213.207.196.26 port 47074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:21:07 host2 sshd[1411987]: Disconnected from invalid user kali 213.207.196.26 port 47788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.207.196.26
country_id: 130758
description:
Nov  6 14:22:25 host2 sshd[1413356]: Disconnected from invalid user guest 213.207.196.26 port 33902 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 14:24:51 host2 sshd[1415644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Nov  6 14:28:45 host2 sshd[1419486]: Disconnected from invalid user rich 62.97.44.51 port 58874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.2.4.105
country_id: 1819730
description:
Nov  6 14:31:19 host2 sshd[1421837]: Disconnected from invalid user centos 20.2.4.105 port 53888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov  6 14:35:11 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.92, session=<ATvKXOlCnIul4z73>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-06 14:40:31 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:45887: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.212
country_id: 6252001
description:
Nov  6 14:41:25 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.177.212, lip=66.85.158.92, session=<sKsTc+lC8OAUQbHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 14:45:29 host2 sshd[1435292]: Disconnected from invalid user user 2.57.121.25 port 42886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.205.126
country_id: 3175395
description:
Nov  6 14:57:53 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.70.205.126, lip=66.85.158.91, TLS, session=<NIv1rOlCldVtRs1+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.171
country_id: 6252001
description:
Nov  6 14:57:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.171, lip=66.85.158.91, session=<GdwnrulCBssofK2r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-06 14:58:05 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:54640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.42
country_id: 3865483
description:
Nov  6 14:58:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.96.193.42, lip=66.85.158.91, TLS, session=<e1gerulCG866YMEq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-06 14:57:34 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3008: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.67.28.239
country_id: 1643084
description:
2025-11-06 14:58:56 dovecot_login authenticator failed for ([36.67.28.239]) [36.67.28.239]:6731: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-11-06 14:59:14 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:47665: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov  6 15:00:54 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.92, lip=66.85.158.91, TLS, session=<tWfCuOlCivfN0h9c>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.152.158
country_id: 6252001
description:
Nov  6 15:03:05 host2 pure-ftpd[1452032]: (?@20.98.152.158) [INFO] New connection from 20.98.152.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-06 15:05:53 dovecot_plain authenticator failed for (ingoms) [12.150.243.22]:18815: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 15:10:10 host2 sshd[1458652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.163.10.186
country_id: 6252001
description:
Nov  6 15:11:13 host2 pure-ftpd[1459711]: (?@20.163.10.186) [INFO] New connection from 20.163.10.186


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov  6 15:14:21 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<fj3b6OlCgpBHBobn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Nov  6 15:24:10 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<rmjsC+pCBrqnXpI0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov  6 15:24:21 host2 pure-ftpd[1471892]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 15:28:03 host2 sshd[1478013]: Disconnected from invalid user annalise 62.60.131.157 port 19617 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:28:57 host2 sshd[1479456]: Disconnected from invalid user rupesh 190.210.69.245 port 58318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.90
country_id: 6252001
description:
Nov  6 15:31:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.90, lip=66.85.158.92, TLS handshaking: Connection closed, session=<D6UHJupCVsEs3Lxa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.90
country_id: 6252001
description:
Nov  6 15:31:33 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=44.220.188.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<T+pVJupCPLIs3Lxa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:32:12 host2 sshd[1483877]: Disconnected from invalid user noc 190.210.69.245 port 41124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.115.112
country_id: 6251999
description:
Nov  6 15:34:51 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.89.115.112, lip=66.85.158.91, TLS, session=<BcwmMupCXLmfWXNw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.210.69.245
country_id: 3865483
description:
Nov  6 15:35:46 host2 sshd[1489022]: Disconnected from invalid user db2fenc1 190.210.69.245 port 52166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 15:37:17 host2 sshd[1491075]: Disconnected from invalid user annalise 62.60.131.157 port 27991 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.168
country_id: 6252001
description:
Nov  6 15:38:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.168, lip=66.85.158.92, session=<Us6bP+pCMqQs3Lmo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-06 15:39:37 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:55183: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-06 15:40:23 dovecot_login authenticator failed for host-95-229-5-248.business.telecomitalia.it [95.229.5.248]:40266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-06 15:40:33 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:47962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 16:01:21 host2 sshd[1520384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-06 16:06:23 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:33701: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-06 16:06:37 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:52883: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  6 16:07:29 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<hFPgpupCQLZChJl+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  6 16:07:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS, session=<GyH7pupC0sxChJl+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.135.131
country_id: 6252001
description:
Nov  6 16:12:06 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<WUdYt+pCWN9HBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Nov  6 16:12:06 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<m1Bat+pCxuFHBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov  6 16:25:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS: Connection closed, session=<y1lj5upCIMHLN4MD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  6 16:25:59 host2 sshd[1544765]: Disconnected from invalid user user 2.57.121.25 port 34704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  6 16:26:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<dvF+7OpCnaktKyHS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.12.70.143
country_id: 690791
description:
Nov  6 16:27:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=194.12.70.143, lip=66.85.158.91, TLS, session=<x2Vn7OpCHeXCDEaP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov  6 16:27:28 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.92, session=<4D9V7upCT5YtKyHS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.32.114
country_id: 3865483
description:
Nov  6 16:27:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.227.32.114, lip=66.85.158.91, TLS, session=<K9Ch7epC7ewt4yBy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  6 16:40:12 host2 sshd[1557832]: Disconnected from invalid user caitlynn 62.60.131.157 port 13582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-06 16:45:14 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:41113: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-06 16:45:36 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:41924: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 16:46:44 host2 sshd[1564365]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov  6 16:51:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=</fl9QutCiqJChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-06 16:57:20 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:36607: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-06 16:57:33 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:60705: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-06 17:01:02 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:37729: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-11-06 17:00:31 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:52422: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-11-06 17:09:47 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:38285: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-06 17:10:11 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:54916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-06 17:15:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60027: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.229.16.142
country_id: 241170
description:
Nov  6 17:17:25 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=156.229.16.142, lip=66.85.158.91, session=<YO/7oOtCbMqc5RCO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-11-06 17:18:39 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:55715: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-06 17:18:42 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:36356: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-06 17:19:15 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:8797: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.229.16.142
country_id: 241170
description:
Nov  6 17:19:21 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=156.229.16.142, lip=66.85.158.92, session=<7Hnip+tCGr2c5RCO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.30
country_id: 1733045
description:
2025-11-06 17:20:37 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:42918: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-06 17:33:11 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:50246: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2025-11-06 17:32:38 dovecot_login authenticator failed for ([49.124.145.62]) [49.124.145.62]:41720: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-06 17:33:28 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59911: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 17:38:02 host2 sshd[1614493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.213.230.149
country_id: 1512440
description:
Nov  6 17:39:39 host2 pure-ftpd[1616202]: (?@185.213.230.149) [INFO] New connection from 185.213.230.149


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-06 17:55:03 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:48143: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.70
country_id: 2635167
description:
Nov  6 17:54:13 host2 pure-ftpd[1632731]: (?@87.236.176.70) [INFO] New connection from 87.236.176.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-11-06 17:58:42 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:57258: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-06 17:59:37 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:51770: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-06 17:59:48 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:50840: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.112
country_id: 2635167
description:
Nov  6 18:00:40 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.112, lip=66.85.158.92, TLS, session=<Gs6iO+xC/da594lw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.191
country_id: 3469034
description:
Nov  6 18:00:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=168.194.154.191, lip=66.85.158.91, TLS, session=<7vqCOuxC47Gowpq/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.125
country_id: 3175395
description:
Nov  6 18:01:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.178.125, lip=66.85.158.91, TLS, session=<CxD0O+xCQorZGrJ9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-06 18:07:44 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:33347: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.211.172
country_id: 1522867
description:
2025-11-06 18:08:00 dovecot_login authenticator failed for 178.89.211.172.dynamic.telecom.kz [178.89.211.172]:41467: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2025-11-06 18:08:33 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:48636: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:15:30 host2 sshd[1657373]: Disconnected from invalid user harsh 20.47.72.43 port 35108 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-06 18:16:38 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:45016: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-06 18:16:48 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:60423: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-06 18:16:57 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:51258: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-06 18:16:38 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:38902: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2025-11-06 18:17:16 dovecot_login authenticator failed for 95-210-105-142.ip.skylogicnet.com [95.210.105.142]:33501: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:18:33 host2 sshd[1660727]: Disconnected from invalid user mk 20.47.72.43 port 39614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:19:59 host2 sshd[1661980]: Disconnected from invalid user schueler 20.47.72.43 port 55410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.47.72.43
country_id: 1269750
description:
Nov  6 18:21:25 host2 sshd[1663374]: Disconnected from invalid user testuser 20.47.72.43 port 56750 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.70.200.142
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.70.200.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.245.180.175
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 168.245.180.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.16.232.245
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.16.232.245 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.35.141.172
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 136.35.141.172 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.190.133.92
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 99.190.133.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.162.108.89
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.162.108.89 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.210.232.153
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.210.232.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 18:23:41 host2 sshd[1665833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:24:18 host2 sshd[1666497]: Disconnected from invalid user debian 102.210.149.121 port 56826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:26:03 host2 sshd[1668121]: Disconnected from invalid user ruby 102.210.149.121 port 33154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Nov  6 18:29:23 host2 sshd[1671644]: Disconnected from invalid user user 102.210.149.121 port 42268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  6 18:40:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<rwJTy+xC5pYjygmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.132
country_id: 1269750
description:
Nov  6 18:46:36 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.8.118.132, lip=66.85.158.91, TLS, session=<csLX3uxCAYlnCHaE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.153
country_id: 798544
description:
Nov  6 18:46:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=85.202.108.153, lip=66.85.158.91, TLS, session=<lhWw3exCsJJVymyZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-06 18:55:36 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:56035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-06 18:55:28 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:52521: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.188.81.67
country_id: 6252001
description:
Nov  6 19:04:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.188.81.67, lip=66.85.158.91, session=<Z5ueH+1CJuQ0vFFD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.224.96
country_id: 6252001
description:
Nov  6 19:07:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.118.224.96, lip=66.85.158.92, session=<FrVMKu1CxqEUduBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  6 19:15:18 host2 sshd[1717542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-06 19:17:59 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:52244: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-06 19:18:26 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:42971: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:18:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yR43Uu1CnIADg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-06 19:18:10 dovecot_login authenticator failed for ([182.75.215.245]) [182.75.215.245]:60156: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-06 19:18:24 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:54156: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:19:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<r6wGV+1CBNYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:21:04 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VggmW+1CqMsDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov  6 19:21:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<syssXe1CvsgDg9cm>


