# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 11:40:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<n0M/sh9GLIQ+PIcl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 17 11:45:18 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS, session=<o4S2xB9Gg7W594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 11:47:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</48/yx9GaI0+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 11:47:31 host2 sshd[1902053]: Disconnected from invalid user user 2.57.121.25 port 14070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 11:49:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<e0uV1B9GBps+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.33
country_id: 289688
description:
2025-12-17 11:50:00 dovecot_login authenticator failed for (ADMIN) [95.181.234.33]:49940: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 11:51:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<bg+62R9GaJU+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 11:51:21 host2 sshd[1904979]: Disconnected from invalid user user2 64.227.176.54 port 39116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 11:51:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FkPT2h9GEME+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-17 11:52:16 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:46808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-17 11:52:35 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:44725: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:53:16 host2 sshd[1906373]: Disconnected from invalid user db2admin 156.241.128.48 port 44558 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec 17 11:53:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.48, lip=66.85.158.92, TLS, session=<9M9O4R9G0OSTuYQw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 11:53:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Cc3Q4h9G1oM+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-17 11:53:07 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:51826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:54:05 host2 sshd[1907208]: Disconnected from invalid user ubuntu 156.241.128.48 port 56848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.51
country_id: 1269750
description:
2025-12-17 11:55:13 dovecot_login authenticator failed for (ADMIN) [103.108.174.51]:12659: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-17 11:56:24 dovecot_plain authenticator failed for (lastagota) [102.53.15.17]:56365: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 11:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<n2mo7x9GvrU+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:58:23 host2 sshd[1910627]: Disconnected from invalid user prom 156.241.128.48 port 45858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 11:59:37 host2 sshd[1911485]: Disconnected from invalid user michael 64.227.176.54 port 58954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:59:47 host2 sshd[1911574]: Disconnected from invalid user mj 156.241.128.48 port 42194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 12:00:45 host2 sshd[1912421]: Disconnected from invalid user deploy 64.227.176.54 port 36044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 12:01:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<3ah5/R9GGoI+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 12:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Ip+6AiBG/pY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 12:03:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<WQEdBiBGYoc+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:04:22 host2 sshd[1915221]: Disconnected from invalid user ruser 203.145.34.93 port 53682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:04:30 host2 sshd[1915268]: Disconnected from invalid user admin 199.195.254.215 port 33856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:05:23 host2 sshd[1916024]: Disconnected from invalid user cgpexpert 199.195.254.215 port 46378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:05:12 host2 sshd[1915802]: Disconnected from invalid user github 194.107.115.65 port 28504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:06:29 host2 sshd[1916907]: Disconnected from invalid user centos 194.107.115.65 port 53418 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Dec 17 12:06:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.55, lip=66.85.158.92, TLS, session=<i4GwESBG5P6TuYQ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:07:02 host2 sshd[1917379]: Disconnected from invalid user hik 199.195.254.215 port 43186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:07:43 host2 sshd[1918046]: Disconnected from invalid user arjun 202.70.78.237 port 4270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:08:01 host2 sshd[1918283]: Disconnected from invalid user sftp 203.145.34.93 port 58130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-17 12:08:21 dovecot_plain authenticator failed for (marize) [5.26.190.79]:51784: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.6
country_id: 290557
description:
2025-12-17 12:08:23 dovecot_login authenticator failed for (ADMIN) [217.138.162.6]:61619: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:08:48 host2 sshd[1918838]: Disconnected from invalid user hadoop 194.107.115.65 port 46736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 12:08:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<zVw/FiBG8s0+PIdf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Dec 17 12:08:41 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<KqVSGCBGsJ3CpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:09:37 host2 sshd[1919371]: Disconnected from invalid user arjun 203.145.34.93 port 45642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:09:14 host2 sshd[1919135]: Disconnected from invalid user admin 202.70.78.237 port 61130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:09:31 host2 sshd[1919300]: Disconnected from invalid user hello 199.195.254.215 port 52514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 17 12:09:52 host2 sshd[1919561]: Disconnected from invalid user neeraj 213.142.151.19 port 43534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:11:30 host2 sshd[1920963]: Disconnected from invalid user ec2-user 202.70.78.237 port 8774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:11:45 host2 sshd[1921106]: Disconnected from invalid user admin 45.78.225.21 port 44924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:11:11 host2 sshd[1920750]: Disconnected from invalid user vpsuser 203.145.34.93 port 48710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec 17 12:11:16 host2 sshd[1920803]: Disconnected from invalid user runner 213.142.151.19 port 43258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:11:57 host2 sshd[1921298]: Disconnected from invalid user erp 203.145.34.93 port 32830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-17 12:11:59 dovecot_plain authenticator failed for (dulunder) [65.20.233.110]:48697: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 12:13:50 host2 pure-ftpd[1922698]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:14:14 host2 sshd[1922934]: Disconnected from invalid user sftp 45.78.225.21 port 56162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 12:14:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<OBPGLiBG6tc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.174
country_id: 1880251
description:
2025-12-17 12:16:40 dovecot_login authenticator failed for (ADMIN) [156.146.57.174]:60534: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:17:51 host2 sshd[1925991]: Disconnected from invalid user sftp_user 179.32.207.251 port 42992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 17 12:18:32 host2 sshd[1926499]: Disconnected from invalid user acs 51.195.46.102 port 35474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:18:33 host2 sshd[1926511]: Disconnected from invalid user grid 179.32.207.251 port 57134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:19:14 host2 sshd[1927099]: Disconnected from invalid user dayz 179.32.207.251 port 43034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.77
country_id: 6252001
description:
Dec 17 12:19:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=195.184.76.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I8ZZPyBGr6jDuExN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.79
country_id: 6252001
description:
Dec 17 12:19:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.79, lip=66.85.158.91, TLS: Connection closed, session=<N//3PyBGVb7DuExP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.78
country_id: 6252001
description:
Dec 17 12:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.78, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<u+LjQCBGI9rDuExO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.73
country_id: 6252001
description:
Dec 17 12:20:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.73, lip=66.85.158.91, TLS: Connection closed, session=<1+kSQSBGK7HDuExJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:21:16 host2 sshd[1928884]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 17 12:21:28 host2 sshd[1929022]: Disconnected from invalid user issabel 116.71.136.125 port 35764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-17 12:21:42 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:54944: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-17 12:22:13 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46178: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 17 12:22:59 host2 sshd[1930234]: Disconnected from invalid user runner 116.71.136.125 port 48458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.76.231
country_id: 6252001
description:
Dec 17 12:24:36 host2 sshd[1931591]: Disconnected from invalid user morgan 34.66.76.231 port 48572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-17 12:25:41 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:60355: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 12:26:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<TrmlVyBGoMU+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:26:37 host2 sshd[1933353]: Disconnected from invalid user lighthouse 45.78.225.21 port 42700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 17 12:25:57 host2 sshd[1932843]: Disconnected from invalid user bodega 51.195.46.102 port 36494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-17 12:26:03 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:33590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 17 12:27:29 host2 sshd[1934197]: Disconnected from invalid user yxsong 187.51.208.158 port 47141 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:28:35 host2 sshd[1935074]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 17 12:28:16 host2 sshd[1934836]: Disconnected from invalid user u1 77.87.40.114 port 40930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:28:23 host2 sshd[1934940]: Disconnected from invalid user john 152.32.172.161 port 39172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Dec 17 12:29:17 host2 sshd[1935550]: Disconnected from invalid user xmr 77.87.40.114 port 36580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:30:27 host2 sshd[1936590]: Disconnected from invalid user localhost 43.130.148.217 port 46866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:31:26 host2 sshd[1937237]: Disconnected from invalid user elasticsearch 152.32.172.161 port 52604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:31:34 host2 sshd[1937392]: Disconnected from invalid user ubuntu 43.130.148.217 port 38536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:32:14 host2 sshd[1938009]: Disconnected from invalid user ts 152.32.172.161 port 41374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:32:38 host2 sshd[1938552]: Disconnected from invalid user ubuntu 78.109.200.147 port 34938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:32:44 host2 sshd[1938605]: Disconnected from invalid user user1 35.196.84.166 port 59846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:33:02 host2 sshd[1938928]: Disconnected from invalid user mastodon 43.130.148.217 port 57824 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:34:41 host2 sshd[1940649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:34:19 host2 sshd[1940264]: Disconnected from invalid user hack 78.109.200.147 port 39976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:34:28 host2 sshd[1940393]: Disconnected from invalid user saude 152.32.172.161 port 43786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:34:38 host2 sshd[1940605]: Disconnected from invalid user n 43.130.148.217 port 42208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:35:06 host2 sshd[1941209]: Disconnected from invalid user postgres 35.196.84.166 port 38800 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec 17 12:35:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, session=<rNO2dyBGFt4fDiAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:36:37 host2 sshd[1942955]: Disconnected from invalid user scan 78.109.200.147 port 56106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:35:54 host2 sshd[1942086]: Disconnected from invalid user username 35.196.84.166 port 43690 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.188
country_id: 2635167
description:
Dec 17 12:36:16 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.188, lip=66.85.158.92, TLS, session=<X//3eiBGt6dX7LC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-17 12:37:39 dovecot_plain authenticator failed for (chodies) [65.20.148.165]:36618: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.69.154.4
country_id: 1643084
description:
Dec 17 12:38:36 host2 sshd[1944995]: Disconnected from invalid user debian 36.69.154.4 port 34788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:38:51 host2 sshd[1945234]: Disconnected from invalid user test1 103.171.85.124 port 54298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:39:45 host2 sshd[1945999]: Disconnected from invalid user ubuntu 103.171.85.124 port 42018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:40:28 host2 sshd[1946944]: Disconnected from invalid user debian 103.171.85.124 port 40254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 12:43:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lgRAlCBGnLY+PIcr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-17 12:43:43 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.23
country_id: 6290252
description:
2025-12-17 12:43:56 dovecot_login authenticator failed for (ADMIN) [37.46.115.23]:52892: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 12:44:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<EbEZlyBGyLQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.129
country_id: 2661886
description:
2025-12-17 12:44:32 dovecot_login authenticator failed for (ADMIN) [46.246.8.129]:56419: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:45:27 host2 sshd[1952381]: Disconnected from invalid user yzx 103.171.85.124 port 43694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 12:46:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=</QCaniBG2KU+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.163.85
country_id: 1269750
description:
2025-12-17 12:50:23 dovecot_plain authenticator failed for (Z69Q27X) [49.43.163.85]:58862: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.79.164
country_id: 2328926
description:
2025-12-17 12:57:33 dovecot_plain authenticator failed for (CUF28CYXYG583UI9) [98.97.79.164]:26116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 13:00:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6Dzz0SBGHq8+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2025-12-17 12:59:58 dovecot_login authenticator failed for (ADMIN) [138.199.59.240]:34812: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 17 13:03:51 host2 sshd[1972259]: Disconnected from invalid user guest 152.32.203.205 port 42446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 13:03:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<HMx52iBGBtA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 13:03:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<hXpw3CBGJoI+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:05:27 host2 sshd[1973645]: Disconnected from invalid user newuser 104.248.245.89 port 35286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 17 13:06:09 host2 sshd[1974160]: Disconnected from invalid user uftp 152.32.203.205 port 49714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:09:17 host2 sshd[1976833]: Disconnected from invalid user sammy 52.224.240.74 port 51726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 17 13:09:47 host2 sshd[1977140]: Disconnected from invalid user clock 103.118.114.22 port 42892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-17 13:10:41 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (cruetchini) [174.161.27.82]:46094: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:10:50 host2 sshd[1978328]: Disconnected from invalid user abdi 104.248.245.89 port 51170 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:11:52 host2 sshd[1979124]: Disconnected from invalid user userm 104.248.245.89 port 54890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.178
country_id: 2960313
description:
2025-12-17 13:11:01 dovecot_login authenticator failed for (ADMIN) [37.46.113.178]:28448: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 13:15:49 host2 pure-ftpd[1983473]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 13:16:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jGMBCiFGTNU+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 13:19:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53114: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 13:22:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<KmB4HiFG3uQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.5
country_id: 3194884
description:
2025-12-17 13:21:19 dovecot_login authenticator failed for (ADMIN) [176.125.229.5]:12920: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:24:01 host2 sshd[1990728]: Disconnected from invalid user omm 52.224.240.74 port 44536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-17 13:24:35 dovecot_plain authenticator failed for (galanic) [102.53.15.18]:57722: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:24:54 host2 sshd[1991711]: Disconnected from invalid user clock 52.224.240.74 port 52140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.20
country_id: 174982
description:
2025-12-17 13:31:07 dovecot_login authenticator failed for (ADMIN) [185.253.160.20]:20185: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 54.37.131.169 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:34:24 host2 sshd[1999217]: Disconnected from invalid user developer 177.54.62.66 port 54697 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-17 13:35:41 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:35542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:35:49 host2 sshd[2000551]: Disconnected from invalid user ubuntu 177.54.62.66 port 56304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-17 13:36:01 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:42632: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-17 13:35:17 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (flunsich) [78.68.37.25]:55069: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:36:35 host2 sshd[2001244]: Disconnected from invalid user vhserver 177.54.62.66 port 52957 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Dec 17 13:36:53 host2 sshd[2001492]: Disconnected from invalid user drcom 154.221.28.214 port 33178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 17 13:37:04 host2 sshd[2001625]: Disconnected from invalid user acct 152.32.218.149 port 43204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 17 13:38:21 host2 sshd[2002457]: Disconnected from invalid user vboxuser 152.32.218.149 port 57348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.105
country_id: 2661886
description:
2025-12-17 13:39:07 dovecot_login authenticator failed for (ADMIN) [46.246.8.105]:1682: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:39:47 host2 sshd[2003487]: Disconnected from invalid user pay 81.30.162.18 port 39358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 17 13:40:19 host2 sshd[2004001]: Disconnected from invalid user ubuntu 157.245.55.165 port 37620 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.245
country_id: 6252001
description:
Dec 17 13:41:18 host2 pure-ftpd[2004664]: (?@205.210.31.245) [INFO] New connection from 205.210.31.245


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:41:25 host2 sshd[2004738]: Disconnected from invalid user jasper 81.30.162.18 port 57118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 17 13:41:37 host2 sshd[2004977]: Disconnected from invalid user administrator 157.245.55.165 port 57592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:43:03 host2 sshd[2005958]: Disconnected from invalid user user1 81.30.162.18 port 46650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Dec 17 13:45:33 host2 sshd[2008512]: Disconnected from invalid user sunil 103.217.145.104 port 54398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-17 13:46:15 dovecot_plain authenticator failed for (shillis) [62.73.121.209]:46856: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-17 13:46:46 dovecot_plain authenticator failed for (progrifust) [65.20.188.156]:53396: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 13:47:09 host2 sshd[2009836]: Disconnected from invalid user unique 62.60.131.157 port 32247 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.145.104
country_id: 1643084
description:
Dec 17 13:47:17 host2 sshd[2009990]: Disconnected from invalid user dspace 103.217.145.104 port 56542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.208
country_id: 6252001
description:
Dec 17 13:49:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.208, lip=66.85.158.92, session=<5RXugCFGMXBAPpzQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Dec 17 13:49:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS: Connection closed, session=<qNykgSFGgKJAPpzK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-12-17 13:53:24 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:27323: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 17 13:54:03 host2 sshd[2016063]: Disconnected from invalid user monitor 103.243.27.122 port 60346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 17 13:54:40 host2 sshd[2016930]: Disconnected from invalid user vivek 194.107.115.2 port 28426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.47.74
country_id: 2750405
description:
Dec 17 13:56:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.172.47.74, lip=66.85.158.92, session=<gExgmiFGds2nrC9K>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 17 13:57:03 host2 sshd[2018651]: Disconnected from invalid user backups 103.243.27.122 port 37714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 17 13:57:09 host2 sshd[2018720]: Disconnected from invalid user arthur 156.238.252.133 port 44926 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Dec 17 13:58:17 host2 sshd[2019575]: Disconnected from invalid user dspace 156.238.252.133 port 44688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 17 13:58:19 host2 sshd[2019578]: Disconnected from invalid user steam 152.52.15.214 port 58086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.25
country_id: 298795
description:
2025-12-17 13:58:43 dovecot_login authenticator failed for (ADMIN) [188.213.34.25]:53327: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 17 13:59:41 host2 sshd[2020618]: Disconnected from invalid user test 152.52.15.214 port 26698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 17 14:01:42 host2 sshd[2022324]: Disconnected from invalid user ts3server 158.69.210.167 port 46718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 14:02:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8bBvrSFGLLg+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 17 14:03:16 host2 sshd[2023591]: Disconnected from invalid user app 64.227.156.63 port 41682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 14:03:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<DahlsiFGUsY+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 17 14:03:50 host2 sshd[2024198]: Disconnected from invalid user minikube 158.69.210.167 port 54768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 17 14:05:06 host2 sshd[2025268]: Disconnected from invalid user mk 64.227.156.63 port 44386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:05:30 host2 sshd[2025575]: Disconnected from invalid user peng 96.78.175.36 port 41178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:06:02 host2 sshd[2025951]: Disconnected from invalid user ubuntu 96.78.175.36 port 35680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:06:32 host2 sshd[2026308]: Disconnected from invalid user sybase 96.78.175.36 port 41908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 17 14:08:55 host2 sshd[2028197]: Disconnected from invalid user temp 152.32.238.146 port 56890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 17 14:09:30 host2 sshd[2028584]: Disconnected from invalid user ubuntu 152.32.238.146 port 50884 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 14:10:30 host2 sshd[2029439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:11:13 host2 sshd[2029892]: Disconnected from invalid user odoo 165.154.121.2 port 52842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:10:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<y2EByyFG/Ks+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.40
country_id: 798549
description:
2025-12-17 14:10:52 dovecot_login authenticator failed for (ADMIN) [143.244.52.40]:34975: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 17 14:11:51 host2 sshd[2030283]: Disconnected from invalid user ahmed 201.249.205.94 port 55644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 14:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<fFOg2CFGXrM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:14:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oOwg2iFGKtM+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:16:07 host2 sshd[2033758]: Disconnected from invalid user peng 165.154.121.2 port 45648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2025-12-17 14:16:08 dovecot_login authenticator failed for (Copy-of-VM-2022) [45.94.31.41]:28526: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 14:16:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+TVj4SFGeLk+PIcf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 14:17:49 host2 sshd[2035006]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 14:17:46 host2 pure-ftpd[2034962]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.222
country_id: 6252001
description:
Dec 17 14:18:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.222, lip=66.85.158.92, session=<0LtT6CFGDubG6xje>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-17 14:20:58 dovecot_plain authenticator failed for (sconsh) [65.20.191.12]:39819: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 17 14:21:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<O3M+8yFGprY+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 14:22:32 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (uplidya) [196.47.172.253]:48209: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.35
country_id: 1814991
description:
2025-12-17 14:24:43 dovecot_login authenticator failed for (ADMIN) [188.241.80.35]:3161: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-17 14:25:48 dovecot_plain authenticator failed for (talkindema) [149.62.239.4]:56700: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.23
country_id: 2589581
description:
2025-12-17 14:26:54 dovecot_login authenticator failed for (ADMIN) [176.125.228.23]:1658: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-17 14:26:57 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (twineromy) [73.13.220.220]:41410: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-17 14:26:54 dovecot_plain authenticator failed for (nonress) [65.20.191.12]:57056: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-17 14:28:23 dovecot_plain authenticator failed for (rhonesight) [5.26.190.79]:41060: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-17 14:28:26 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (herehorl) [69.142.126.37]:58174: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 14:28:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<4ecoDSJGJrU+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-17 14:29:55 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:56592: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-17 14:30:14 dovecot_login authenticator failed for ([90.160.139.163]) [90.160.139.163]:50737: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:31:48 host2 sshd[2046569]: Disconnected from invalid user hz 165.154.121.2 port 47080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-17 14:32:25 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (morasila) [66.177.30.53]:34466: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:33:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0lsUHyJGGOM+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 14:38:44 dovecot_plain authenticator failed for (ablen) [65.20.153.146]:56474: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 14:38:49 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (motherled) [196.47.172.253]:58619: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-17 14:39:35 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:59694: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.128
country_id: 6252001
description:
2025-12-17 14:39:51 dovecot_login authenticator failed for wsip-184-191-250-128.fv.ks.cox.net [184.191.250.128]:41110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.84
country_id: 390903
description:
2025-12-17 14:43:22 dovecot_login authenticator failed for (ADMIN) [79.127.181.84]:22568: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:43:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uz9pQyJG9NE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.205
country_id: 2510769
description:
2025-12-17 14:48:48 dovecot_login authenticator failed for (ADMIN) [212.102.49.205]:3731: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-17 14:49:56 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (masaghte) [37.150.8.174]:40238: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 14:52:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<1txSYCJGUuI+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:53:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ZWvkZSJGHNU+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.42.136.22
country_id: 2750405
description:
Dec 17 14:54:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.42.136.22, lip=66.85.158.91, session=<uHj3aCJGsuuYKogW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 14:54:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<OGnpaSJGIJ8+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-17 14:54:58 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:45896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-17 14:55:10 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:50074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:55:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<I017bSJGxLc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 14:56:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<oA+XbyJG6o8+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.50.226
country_id: 2921044
description:
Dec 17 14:56:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=8.211.50.226, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<alQBcSJGvnQI0zLi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:58:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4blAdiJGeM0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-17 14:58:40 dovecot_plain authenticator failed for (melcal) [102.53.15.56]:43338: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 14:59:50 host2 sshd[2070639]: Disconnected from invalid user dion 62.60.131.157 port 15997 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.115
country_id: 2750405
description:
2025-12-17 15:00:01 dovecot_login authenticator failed for (ADMIN) [158.173.3.115]:2751: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-17 15:00:26 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (couped) [73.0.235.30]:41660: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 15:01:21 host2 sshd[2072007]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 15:04:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<heW/iyJGBqk+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 15:04:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<vEW1jCJG/r8+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-17 15:10:18 dovecot_plain authenticator failed for (ousapyint) [5.11.141.74]:41958: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 15:11:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<88zQpSJGHoM+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-17 15:15:30 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:49923: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-17 15:15:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-17 15:15:56 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:53138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-17 15:16:04 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:57690: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.41
country_id: 617790
description:
2025-12-17 15:16:28 dovecot_login authenticator failed for ae0-3101.cr01.ch.md.as43289.net (ADMIN) [178.175.129.41]:42464: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.165
country_id: 102358
description:
2025-12-17 15:18:06 dovecot_login authenticator failed for (ADMIN) [95.181.235.165]:6587: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 15:19:49 host2 pure-ftpd[2089598]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 15:20:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<A26gxSJGerw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-17 15:22:35 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:48164: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 15:22:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ofy2zSJGkKs+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-17 15:22:52 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:42959: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-17 15:24:05 dovecot_login authenticator failed for ([125.18.154.73]) [182.95.226.118]:46928: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-17 15:24:22 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:33752: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-17 15:26:18 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (gical) [98.222.93.199]:40680: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.98
country_id: 6252001
description:
Dec 17 15:26:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.98, lip=66.85.158.91, session=<4Tzh2yJGFP3G6xhi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 15:29:07 host2 sshd[2098355]: Disconnected from invalid user dion 62.60.131.157 port 49265 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 15:28:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<RW6Q4iJGAug+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 15:29:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<C3VS5yJG2Lw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 15:31:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<e1Zf7CJGVqs+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 15:30:38 dovecot_plain authenticator failed for (rellows) [65.20.133.208]:47676: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:32:40 host2 sshd[2101185]: Disconnected from invalid user user14 78.100.64.148 port 56120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:36:20 host2 sshd[2104211]: Disconnected from invalid user rancher 78.100.64.148 port 7432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:37:11 host2 sshd[2104821]: Disconnected from invalid user chin 78.100.64.148 port 10584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-17 15:38:22 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:51082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.183
country_id: 6252001
description:
Dec 17 15:38:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.183, lip=66.85.158.91, TLS, session=<OgAgCCNGbvaTuYS3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 15:39:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<lSxsCiNGitc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 15:42:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<ShqZFCNGBoA+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 15:44:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<4xGuHSNGoqI+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.176
country_id: 6251999
description:
2025-12-17 15:45:44 dovecot_login authenticator failed for (ADMIN) [149.22.95.176]:34168: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Dec 17 15:46:25 host2 pure-ftpd[2113363]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.14.118.150
country_id: 2802361
description:
Dec 17 15:49:19 host2 pure-ftpd[2115353]: (?@34.14.118.150) [INFO] New connection from 34.14.118.150


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 15:49:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<iXT/LiNG1sc+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 15:51:02 dovecot_plain authenticator failed for (entiotole) [65.20.133.208]:41138: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-17 15:51:04 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (copose) [174.169.224.27]:60578: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 15:51:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oYcZNCNGrMM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.62.56.52
country_id: 1694008
description:
2025-12-17 15:50:24 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [158.62.56.52]:62483: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.167.198
country_id: 149590
description:
2025-12-17 15:50:34 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [102.69.167.198]:63255: 535 Incorrect authentication data (set_id=httpsaccounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-17 15:50:45 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (pinsager) [73.196.144.25]:50012: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 15:51:27 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (bepter) [196.47.172.253]:34636: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-17 15:51:24 dovecot_plain authenticator failed for (cabomy) [81.0.54.119]:36749: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 15:56:49 host2 sshd[2122915]: Disconnected from invalid user andrey 182.48.68.82 port 48162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 15:58:17 host2 sshd[2124355]: Disconnected from invalid user armen 182.48.68.82 port 54012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 15:59:13 host2 sshd[2125177]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.19
country_id: 146669
description:
2025-12-17 15:59:52 dovecot_login authenticator failed for (ADMIN) [185.253.162.19]:10541: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 16:01:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<O9NiWCNGGu4+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 16:02:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<yqKYXCNGcsM+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-17 16:02:00 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:38750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-17 16:02:26 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [182.72.143.2]:52394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 16:02:44 host2 sshd[2128571]: Disconnected from invalid user test 182.48.68.82 port 55920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-17 16:02:53 dovecot_login authenticator failed for ([84.214.63.110]) [84.214.63.110]:57744: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.232
country_id: 3017382
description:
Dec 17 16:04:04 host2 pure-ftpd[2130560]: (?@91.231.89.232) [INFO] New connection from 91.231.89.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.225.164
country_id: 3996063
description:
2025-12-17 16:04:09 dovecot_plain authenticator failed for (unbots) [201.166.225.164]:57492: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-17 16:05:14 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3899: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 16:06:26 host2 sshd[2132969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-17 16:05:49 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:38225: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-17 16:05:51 dovecot_plain authenticator failed for (stosious) [102.53.15.180]:33586: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 16:06:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<l8Y2aiNGArU+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:09:05 host2 sshd[2136249]: Disconnected from invalid user jack 23.94.179.104 port 44196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-17 16:09:13 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53252: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.48.208.204
country_id: 3374084
description:
2025-12-17 16:10:10 dovecot_plain authenticator failed for (0SD7X7I) [65.48.208.204]:56805: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2750405
description:
[2025-12-17 16:10:32 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-17 16:09:43 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:43982: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.26.84
country_id: 3175395
description:
Dec 17 16:09:53 host2 sshd[2137049]: Disconnected from invalid user rustserver 151.34.26.84 port 31075 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:11:16 host2 sshd[2138551]: Disconnected from invalid user jenkins 23.94.179.104 port 46612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.152.83.202
country_id: 2264397
description:
Dec 17 16:11:05 host2 sshd[2138381]: Disconnected from invalid user jenkins 89.152.83.202 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Dec 17 16:11:49 host2 sshd[2139142]: Disconnected from invalid user grace 89.152.83.202 port 33856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.23
country_id: 614540
description:
2025-12-17 16:12:57 dovecot_login authenticator failed for (ADMIN) [95.181.236.23]:53522: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:13:54 host2 sshd[2141039]: Disconnected from invalid user user1 23.94.179.104 port 49038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.26.84
country_id: 3175395
description:
Dec 17 16:16:23 host2 sshd[2143351]: Disconnected from invalid user sysadmin 151.34.26.84 port 31532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.16
country_id: 102358
description:
2025-12-17 16:17:40 dovecot_login authenticator failed for (ADMIN) [95.181.235.16]:40919: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 16:21:32 host2 pure-ftpd[2148503]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 16:22:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<x320oiNGmuk+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2750405
description:
[2025-12-17 16:27:38 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 16:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ziL2yyNGVrA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 16:33:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<n2y4zCNGluc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.216.9
country_id: 1861060
description:
2025-12-17 16:34:09 dovecot_login authenticator failed for (ADMIN) [155.2.216.9]:58378: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 16:34:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Msf/ziNGNOA+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:35:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<+9i70CNGuqcDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 16:39:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<nLoW4CNGfsk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.176.80
country_id: 2635167
description:
2025-12-17 16:38:45 dovecot_login authenticator failed for (ADMIN) [181.215.176.80]:48548: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<hI/a5CNGIqADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 16:45:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<xNWa9CNGur7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 16:46:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<ye9c+CNG6LI+PIdm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:46:53 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<oZBB+yNGHtMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:50:03 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<t2ibBiRGbNQDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 17 16:52:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<MmsxDyRGiM3E+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<18U2DyRGJI/E+2YT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<cpE0DyRGnuXE+2YU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<T/c3DyRGDNjE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 16:51:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<EtUTDSRGnuo+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 17 16:52:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<i+suDyRGGtTE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.49
country_id: 2921044
description:
2025-12-17 16:55:28 dovecot_login authenticator failed for (ADMIN) [191.101.157.49]:3961: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 16:57:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<smGHHyRGisw+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.211.86
country_id: 6252001
description:
2025-12-17 16:57:06 dovecot_plain authenticator failed for ([100.64.100.6]) [173.239.211.86]:58165: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 17 16:57:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<bQxxIiRGcNyLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 17 17:04:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<GEY7OSRGmOvE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 17 17:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<zRloOSRGgLXE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 17:04:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61962: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.54
country_id: 241170
description:
Dec 17 17:05:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=156.232.94.54, lip=66.85.158.91, session=<PO67PSRGUqec6F42>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 17:05:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<imP7PiRGqs4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.217
country_id: 3175395
description:
2025-12-17 17:05:50 dovecot_login authenticator failed for (ADMIN) [156.146.41.217]:35550: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 17:08:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<t+rqSCRGtqo+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 17:11:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bfwgUiRGhIs+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.12
country_id: 798549
description:
2025-12-17 17:11:33 dovecot_login authenticator failed for (ADMIN) [143.244.54.12]:14481: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 17:11:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<IGFzUyRGHKA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 17:12:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Ou2IVSRGzpc+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-17 17:12:46 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:34718: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-17 17:13:05 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:59663: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.146
country_id: 6252001
description:
Dec 17 17:15:29 host2 pure-ftpd[2193676]: (?@135.237.125.146) [INFO] New connection from 135.237.125.146


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 17:16:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<RST1YyRGpLU+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-17 17:22:05 dovecot_login authenticator failed for (nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:42770: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-17 17:22:14 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:35088: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 17:23:32 host2 pure-ftpd[2200522]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.10
country_id: 732800
description:
2025-12-17 17:24:58 dovecot_login authenticator failed for (ADMIN) [94.156.14.10]:50791: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:25:00 host2 sshd[2201211]: Disconnected from invalid user fran 193.123.68.117 port 62465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:27:41 host2 sshd[2202492]: Disconnected from invalid user admin 193.123.68.117 port 53351 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.10
country_id: 732800
description:
2025-12-17 17:28:38 dovecot_login authenticator failed for (ADMIN) [94.156.14.10]:37810: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 17:30:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<MmlZlSRGtoQ+PIcl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:30:39 host2 sshd[2204339]: Disconnected from invalid user el 193.123.68.117 port 3047 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Dec 17 17:30:58 host2 sshd[2204486]: Disconnected from invalid user test 36.95.221.140 port 49676 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.236.140
country_id: 1269750
description:
Dec 17 17:32:47 host2 sshd[2205655]: Disconnected from invalid user admin 59.97.236.140 port 46462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 17:33:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9Ej7oSRGUJw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-17 17:33:43 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:46622: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 17:34:55 host2 sshd[2207206]: Disconnected from invalid user user 2.57.121.25 port 10338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 17 17:35:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<HWsUqSRG8Ok+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 17:36:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<yTcfrCRGlMk+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.221.140
country_id: 1643084
description:
Dec 17 17:36:46 host2 sshd[2208301]: Disconnected from invalid user ghost 36.95.221.140 port 41564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:40:07 host2 sshd[2210602]: Disconnected from invalid user log 197.5.145.73 port 56387 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:42:34 host2 sshd[2211900]: Disconnected from invalid user newuser 197.5.145.73 port 56392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:43:57 host2 sshd[2212504]: Disconnected from invalid user zy 198.98.56.205 port 50188 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:44:24 host2 sshd[2212922]: Received disconnect from 197.5.145.73 port 56396:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:44:50 host2 sshd[2213128]: Disconnected from invalid user minecraft 197.5.145.73 port 56397 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:45:29 host2 sshd[2213881]: Disconnected from invalid user newuser 198.98.56.205 port 53768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 17:46:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<MBGAzyRGKrU+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 17:47:18 host2 sshd[2214904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 17 17:47:17 host2 sshd[2214885]: Disconnected from invalid user webadmin 219.92.8.45 port 51388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.174
country_id: 6252001
description:
2025-12-17 17:47:25 dovecot_login authenticator failed for (ADMIN) [102.129.152.174]:5155: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:47:32 host2 sshd[2214990]: Disconnected from invalid user postgres 198.98.56.205 port 39848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 17:47:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<U4fB0iRG1p8+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.185
country_id: 2623032
description:
2025-12-17 17:48:31 dovecot_login authenticator failed for (ADMIN) [188.126.94.185]:13617: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:49:07 host2 sshd[2216097]: Received disconnect from 198.98.56.205 port 41526:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:49:10 host2 sshd[2216130]: Disconnected from invalid user deploy 201.103.234.89 port 47178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 17 17:48:57 host2 sshd[2215934]: Disconnected from invalid user tempuser 219.92.8.45 port 36564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-17 17:50:34 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:35744: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:49:42 host2 sshd[2216407]: Disconnected from invalid user cooper 198.98.56.205 port 57894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-17 17:50:48 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:60004: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:52:32 host2 sshd[2218414]: Disconnected from invalid user sysuser 201.103.234.89 port 55838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:53:06 host2 sshd[2218705]: Disconnected from invalid user jenkins 201.103.234.89 port 51806 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 17:54:35 host2 sshd[2219672]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 18:01:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<0YHJBSVGnN0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 17 18:03:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ryOACyVGcIA+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-17 18:05:36 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:46079: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-17 18:05:48 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:57417: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.86
country_id: 2077456
description:
2025-12-17 18:09:39 dovecot_login authenticator failed for (ADMIN) [179.61.228.86]:45797: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.11
country_id: 614540
description:
2025-12-17 18:11:39 dovecot_login authenticator failed for (ADMIN) [95.181.236.11]:17800: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 18:12:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wIYeLSVGCuY+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Dec 17 18:15:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PNnvNiVG0ZrDuEzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.238
country_id: 6252001
description:
Dec 17 18:15:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.238, lip=66.85.158.92, TLS: Connection closed, session=<pruYNyVGSYrDuEzu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Dec 17 18:15:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OTgIOCVGK77DuEwN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-17 18:19:22 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:56073: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-17 18:19:58 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46880: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 17 18:20:56 host2 pure-ftpd[2236285]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.42.102
country_id: 1643084
description:
2025-12-17 18:21:10 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.42.102]:29446: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-17 18:21:53 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43683: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-17 18:23:18 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:44934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-17 18:23:36 dovecot_login authenticator failed for ([47.247.80.227]) [14.195.19.75]:58062: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 18:25:41 host2 pure-ftpd[2238935]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 17 18:27:42 host2 pure-ftpd[2239784]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-17 18:28:11 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:59334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-17 18:28:48 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:49322: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-17 18:28:57 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:33391: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.226.226
country_id: 6252001
description:
2025-12-17 18:29:15 dovecot_login authenticator failed for (ADMIN) [173.239.226.226]:32654: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 18:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NqXFciVGOsI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 18:32:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZhsWdSVG0Js+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.48
country_id: 6252001
description:
2025-12-17 18:33:32 dovecot_login authenticator failed for (ADMIN) [37.19.198.48]:41616: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 17 18:35:08 host2 sshd[2244435]: Disconnected from invalid user clamav 138.68.104.233 port 56920 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 17 18:35:39 host2 sshd[2244803]: Disconnected from invalid user yash 138.68.104.233 port 42226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 18:35:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<lQQngSVGSpE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-17 18:36:23 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:52562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:07 host2 pure-ftpd[2245697]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 18:36:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<PAn/giVG4s8+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-17 18:36:47 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:35121: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:26 host2 pure-ftpd[2245914]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:37:53 host2 sshd[2246206]: Disconnected from invalid user macro 90.180.197.128 port 51850 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:38:15 host2 pure-ftpd[2246486]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:39:41 host2 sshd[2247534]: Disconnected from invalid user jira 90.180.197.128 port 63887 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-17 18:40:49 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:33523: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-17 18:41:33 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:35075: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-17 18:43:56 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:41743: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-17 18:44:32 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:16962: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-12-17 18:47:49 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:57726: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-17 18:53:27 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:53274: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.235
country_id: 6252001
description:
Dec 17 18:54:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS: Connection closed, session=<6/MwxCVGDL1HBobr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2025-12-17 18:54:58 dovecot_login authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:55023: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-17 18:55:45 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:50160: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 18:56:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<V252yiVGwLw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 18:58:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<3RZ00iVGzMA+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 19:02:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<0GNL3yVGOoQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.234.178.105
country_id: 3469034
description:
Dec 17 19:05:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=177.234.178.105, lip=66.85.158.91, TLS, session=<H++k6CVGpZOx6rJp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.150
country_id: 3865483
description:
Dec 17 19:04:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.250.150, lip=66.85.158.91, TLS, session=<dc9B5yVGE8qzAPqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.26.147
country_id: 798544
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.216.26.147, lip=66.85.158.91, TLS, session=<3FaF5yVGA4Ky2BqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.86.63
country_id: 732800
description:
Dec 17 19:05:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.107.86.63, lip=66.85.158.91, TLS, session=<bKed6CVGjelta1Y/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.50
country_id: 798544
description:
Dec 17 19:04:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=85.202.110.50, lip=66.85.158.91, TLS, session=<Rebk5iVGyKZVym4y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.219
country_id: 690791
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=176.103.25.219, lip=66.85.158.91, TLS, session=<1z+E5yVGlZ2wZxnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.224
country_id: 6290252
description:
Dec 17 19:04:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=109.245.219.224, lip=66.85.158.91, TLS, session=<sof+5yVGEY5t9dvg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.223
country_id: 3175395
description:
Dec 17 19:05:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=185.15.169.223, lip=66.85.158.91, TLS, session=<845+6CVGed65D6nf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-17 19:06:00 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:51721: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-17 19:06:23 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:40302: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:08:14 host2 sshd[2269885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 19:08:50 host2 sshd[2270121]: Disconnected from invalid user user 2.57.121.25 port 44577 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.124
country_id: 6252001
description:
2025-12-17 19:09:00 dovecot_login authenticator failed for (ADMIN) [102.129.153.124]:46337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


