# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:40:26 host2 sshd[1366556]: Disconnected from invalid user andreas 190.156.238.162 port 57298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 01:40:41 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<9StX5BpDCIhK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-09 01:41:39 dovecot_login authenticator failed for (74-95-13-185-sfba.hfc.comcastbusiness.net) [74.95.13.185]:54058: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-09 01:41:50 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:50349: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 01:42:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</25p6xpDP74z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:43:47 host2 sshd[1370013]: Disconnected from invalid user teamspeak 190.156.238.162 port 44480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 01:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<tEpk8xpD7LqP9IUv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:45:26 host2 sshd[1372538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 01:47:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<I8kG+xpDZplD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov  9 01:47:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<BcVG/RpDVP4t4/6Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 01:47:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<ugI3/RpDzKwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 01:48:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<aBLxARtDCDNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 01:51:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<P5oTCxtDGqul6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.81
country_id: 6252001
description:
Nov  9 01:51:54 host2 pure-ftpd[1379570]: (?@198.235.24.81) [INFO] New connection from 198.235.24.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-09 01:53:00 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:53814: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 01:52:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ZAv4DhtDAImYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-09 01:52:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:44448: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 01:53:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<a++xERtD+VK2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 01:53:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<FBJUEhtDrJIv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 01:53:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5Xp5EhtDdtCxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:55:55 host2 sshd[1384367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 01:58:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Ar/BJBtD6p1noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:59:50 host2 sshd[1388564]: Disconnected from invalid user mana 45.78.217.142 port 57762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.134
country_id: 3469034
description:
Nov  9 02:01:13 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=187.120.73.134, lip=66.85.158.91, TLS, session=<2n+2LBtDaNy7eEmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.92
country_id: 798544
description:
Nov  9 02:01:30 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.228.33.92, lip=66.85.158.91, TLS, session=<B1nvLRtDqIZb5CFc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:02:27 host2 sshd[1391993]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:05:00 host2 sshd[1395011]: Disconnected from invalid user svn 45.78.217.142 port 39694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 02:05:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<3zjvPRtDLMA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:07:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<w6kzRRtDyLhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:09:59 host2 sshd[1400515]: Disconnected from invalid user posiflex 45.78.217.142 port 50716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 02:11:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<CvSWUhtDSJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 02:11:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QaS7UhtDMt8r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  9 02:12:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<bb0IVRtD8qKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:14:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<J72LXRtDMNGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 02:15:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<fc36YRtDMrMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 02:15:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<FNnYYRtD0pdm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:17:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<dq72ZhtDAIaP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 02:19:50 host2 sshd[1412316]: Disconnected from invalid user soporte 190.156.238.162 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:20:28 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<OXuhchtD3EQv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:22:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<RA1xeBtDNNhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 02:22:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<M6lIeRtD5M5nVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-09 02:23:09 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:52815: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-09 02:23:26 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:50666: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:24:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7/KmgRtDctM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:27:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<KOM6ihtDsKeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:27:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pfIEjRtDGOiPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:29:01 host2 sshd[1423919]: Disconnected from invalid user sbi 196.196.253.2 port 54686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:31:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<OFqKmBtD3OaPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:30:45 host2 sshd[1426003]: Disconnected from invalid user choi 4.213.177.240 port 57278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:31:32 host2 sshd[1427236]: Disconnected from invalid user tmp 196.196.253.2 port 58416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 02:31:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kTI8mxtDaIZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:33:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<DYnvoBtD+qNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:33:43 host2 sshd[1430171]: Disconnected from invalid user deployer 4.213.177.240 port 58332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 02:34:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wE0RpBtD6OdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 02:34:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<RsFaphtDVJQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:35:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<o+ylphtDZBAv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 02:35:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<EeeMqBtDTpdCYSpH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.33
country_id: 1733045
description:
Nov  9 02:35:38 host2 sshd[1432620]: Disconnected from invalid user gu 202.157.177.33 port 37126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 02:37:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<CJJnrhtDls1K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 02:37:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<0hg1sRtD9JRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 02:40:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Qu60uBtD9OUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 02:40:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<j5g1uRtDgMjRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-09 02:40:18 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:47934: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-09 02:40:30 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:58338: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:40:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7DqjuhtDHsM+PIOJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:42:05 host2 sshd[1439758]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:41:33 host2 sshd[1439149]: Disconnected from invalid user mark 4.213.177.240 port 37616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:42:45 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<KhhSwhtDCqeP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 02:44:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yZOWyBtDLL8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:44:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<5dqiyRtDQqBD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 02:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<iNDzyRtDluwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 02:45:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oFnbyxtDak1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.243
country_id: 3175395
description:
Nov  9 02:46:45 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.243, lip=66.85.158.91, TLS, session=<X3avzxtD8rfZGrPz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.167
country_id: 3175395
description:
Nov  9 02:47:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.43.16.167, lip=66.85.158.91, TLS, session=<vTHT0BtDstm5KxCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-09 02:48:48 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:51457: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-09 02:48:56 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:51655: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-09 02:48:11 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (housion) [73.88.196.91]:51610: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 02:50:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<aFlv3htDKJGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:51:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<J7iF4RtDlLdK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:52:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<98Bn4xtDCoxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 02:52:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CaCT5BtDuTC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:52:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<G9lW5RtDbJmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:56:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<evD08RtDerOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 02:58:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<up25+RtD8Kov+yzS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:00:23 host2 sshd[1461946]: Disconnected from invalid user eun 201.76.120.30 port 37324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:02:05 host2 sshd[1463679]: Disconnected from invalid user redhat 201.76.120.30 port 41600 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  9 03:02:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<727qBxxDgoNChJmC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:03:49 host2 sshd[1466682]: Disconnected from invalid user wangxin 201.76.120.30 port 45876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.71.21
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.71.21, lip=66.85.158.92, session=<xm7IDxxDgWmhI0cV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.214.41
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.214.41, lip=66.85.158.92, session=<F9zODxxD1LekWtYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:07:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4CBCGhxDmKVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  9 03:08:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<jdXTHBxDaJqi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 03:11:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<MCpMKhxD7Okr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-09 03:13:45 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:53574: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:13:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<D61SMRxDfNyxiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-09 03:13:54 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:60878: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:13:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<rZa0MRxDCuaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 03:16:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<6iemOhxD2qlm1PbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-11-09 03:16:31 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:35794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-09 03:16:51 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:36872: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov  9 03:17:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, session=<37qbPhxDSOjG6xhS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-09 03:17:59 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:46403: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 03:18:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<UvIGQRxDKpFK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-09 03:18:18 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:11253: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:19:55 host2 sshd[1486400]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 03:20:07 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<SZ7yRxxDuqMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:20:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<cLwBSRxDiMtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 03:20:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZbqlSRxDNqpnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-09 03:20:58 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:50654: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-09 03:22:21 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:44743: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:23:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<pblSVBxDVuxm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.93
country_id: 1880251
description:
Nov  9 03:23:49 host2 sshd[1491328]: Disconnected from invalid user rocketmq 45.78.205.93 port 34320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Nov  9 03:24:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, TLS: Connection closed, session=<mC1TVxxD/75bxJiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.166
country_id: 3017382
description:
Nov  9 03:24:39 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.166, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xOdIWBxD89JbxJim>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Nov  9 03:24:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iHahVhxD+aZbxJiR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:26:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<R0AHXxxDfoKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:27:44 host2 sshd[1496251]: Disconnected from invalid user user 101.47.48.65 port 57306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:29:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<IUJcahxDzriPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:30:24 host2 sshd[1499618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 03:33:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<upcHeRxDnNOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:34:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<BO0qfBxDcqZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 03:37:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<vOh2hhxDQLxK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 03:38:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Fmb2hxxDdqVn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:39:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<H5XRixxD2KuP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 03:40:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<GdjujxxDoLlA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 03:41:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6pJ7lBxDRqdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 03:41:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mk//lBxDZjQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 03:42:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Q7hGmRxDdrDRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:42:13 host2 sshd[1513251]: Disconnected from invalid user erpnext 43.173.120.212 port 37110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<64sPmBxD5oUrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<V5sImBxD2sArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 03:42:49 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<n+0imRxDNyFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:44:00 host2 sshd[1515171]: Disconnected from invalid user bill 43.173.120.212 port 43570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 03:44:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<At9vnxxDbL1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 03:46:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<2pSKpBxD6KU+PIOL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.199.63.109
country_id: 2802361
description:
Nov  9 03:46:10 host2 pure-ftpd[1519066]: (?@104.199.63.109) [INFO] New connection from 104.199.63.109


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:46:27 host2 sshd[1519448]: Disconnected from invalid user oem 43.173.120.212 port 46374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 03:46:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<BmM3phxDvcAz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:47:38 host2 sshd[1521783]: Disconnected from invalid user ca 43.173.120.212 port 47776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  9 03:48:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<u0UKrBxDTMSOtOyP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 03:49:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=</FFurxxD2OQvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:48:11 host2 sshd[1522451]: Disconnected from invalid user vision 101.36.124.127 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:50:07 host2 sshd[1524712]: Disconnected from invalid user manager 101.36.108.134 port 55000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 03:50:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+8SxsxxD0oql6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:50:17 host2 sshd[1524998]: Disconnected from invalid user toby 101.47.48.65 port 58296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:50:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<zI/5sxxD0I5D2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  9 03:50:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1A1ntRxDMqNChJly>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:51:22 host2 sshd[1526466]: Disconnected from invalid user www 101.36.108.134 port 60238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 03:51:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<1/WZuBxDoXa2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:52:15 host2 sshd[1527620]: Disconnected from invalid user zookeeper 151.49.129.67 port 34890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:52:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<XVYwvBxD4taxiOOT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:52:37 host2 sshd[1528242]: Disconnected from invalid user ca 101.36.108.134 port 41654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:53:35 host2 sshd[1529366]: Disconnected from invalid user cyl 151.49.129.67 port 55816 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 03:54:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jlOrxBxD/i+hI8Fx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.39
country_id: 2921044
description:
Nov  9 03:54:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.29.39, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<roCQwhxDn1Gd5h0n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:55:24 host2 sshd[1532185]: Disconnected from invalid user ec2-user 101.36.124.127 port 52544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 03:56:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Rf9QyBxDOMQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:56:35 host2 sshd[1533444]: Disconnected from invalid user moshe 101.36.124.127 port 43708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 03:56:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<43iYyRxDkuA+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:57:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Jiz9zRxDpKJD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 04:00:43 host2 sshd[1538374]: Disconnected from invalid user pos 151.49.129.67 port 57354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:00:22 host2 sshd[1538071]: Disconnected from invalid user office 101.36.108.134 port 56114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:01:44 host2 sshd[1539358]: Disconnected from invalid user bill 101.36.108.134 port 54868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.43
country_id: 798544
description:
Nov  9 04:01:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=178.216.29.43, lip=66.85.158.91, TLS, session=<7YJG3BxDocyy2B0r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:01:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<dwCz2xxDSI9K4fqm>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.54.213.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.54.213.197: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-09 04:02:45 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (daling) [73.145.107.251]:46286: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.179.44.27
country_id: 1831722
description:
2025-11-09 04:02:53 H=(87.117.231.66) [167.179.44.27]:59077 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <orange@imobust.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.103.58
country_id: 798544
description:
Nov  9 04:02:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.150.103.58, lip=66.85.158.91, TLS, session=<XRpV3RxDnLjClmc6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 04:03:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<SJHh4xxDRpsv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:04:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<JVVC5xxDPOCYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:08:37 host2 sshd[1547697]: Disconnected from invalid user vivek 185.217.131.127 port 38134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.167.33
country_id: 6252001
description:
Nov  9 04:11:35 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.167.33, lip=66.85.158.91, session=<ziomAB1D2ooUU6ch>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:11:19 host2 sshd[1551511]: Disconnected from invalid user public 185.217.131.127 port 58356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 04:11:21 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<zLYy/xxDkpMv7AMK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:12:37 host2 sshd[1553688]: Disconnected from invalid user ice 185.217.131.127 port 57644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 04:12:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QKsLBB1DTIor4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 04:12:55 host2 sshd[1554075]: Disconnected from invalid user rtorrent 101.47.48.65 port 38496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:14:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<atMpCh1Dfr6xiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-09 04:15:37 dovecot_plain authenticator failed for (unbeety) [38.148.95.217]:39219: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:17:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Pi0GFh1DbJRnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:18:40 host2 sshd[1561206]: Disconnected from invalid user mahmoud 45.78.216.136 port 60924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:18:55 host2 sshd[1561514]: Disconnected from invalid user dolphinscheduler 185.217.131.127 port 34582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 04:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<RUBuFx1D8Ltm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 04:19:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<lspgGx1DOLVnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:19:53 host2 sshd[1562666]: Disconnected from invalid user marketing 103.210.22.17 port 58544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:20:45 host2 sshd[1563901]: Disconnected from invalid user couchdb 45.78.218.119 port 49628 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.174
country_id: 6252001
description:
Nov  9 04:22:57 host2 pure-ftpd[1566544]: (?@135.237.125.174) [INFO] New connection from 135.237.125.174


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:22:46 host2 sshd[1566308]: Disconnected from invalid user tobi 103.210.22.17 port 59644 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:24:12 host2 sshd[1568501]: Disconnected from invalid user dong 103.210.22.17 port 56586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 04:25:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xlaVMB1D7ukv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:25:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C1YmMR1DEOxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:25:37 host2 sshd[1570914]: Disconnected from invalid user precious 103.210.22.17 port 56990 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.214.122.74
country_id: 357994
description:
Nov  9 04:27:23 host2 pure-ftpd[1573463]: (?@188.214.122.74) [INFO] New connection from 188.214.122.74


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.13
country_id: 1227603
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.40.13, lip=66.85.158.91, TLS, session=<LcXQOB1D4NBinygN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.12
country_id: 130758
description:
Nov  9 04:27:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=62.133.46.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<C/jjOB1DVOI+hS4M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.135
country_id: 1643084
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.135, lip=66.85.158.91, session=<gZLLOB1DjMOt78mH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.151
country_id: 1522867
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=62.133.47.151, lip=66.85.158.91, session=<jS/IOB1D6Ik+hS+X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.238
country_id: 3144096
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.97.238, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I5DPOB1DIu25/WHu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.140
country_id: 1814991
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.140, lip=66.85.158.91, session=<C7DMOB1DoT688VCM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.139
country_id: 783754
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.139, lip=66.85.158.91, session=<etnPOB1D2qYfq5iL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:28:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<sWzTOx1DNJhK4fqm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.41
country_id: 6252001
description:
Nov  9 04:29:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.41, lip=66.85.158.92, session=<UdT/Ph1Dxr+synYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:31:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<8WUSRh1DqsxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:31:46 host2 sshd[1580458]: Disconnected from invalid user lcx 45.78.216.136 port 38882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-09 04:35:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unmorang) [87.103.126.54]:44654: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-11-09 04:35:43 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (mings) [71.229.43.123]:34910: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:36:51 host2 sshd[1588309]: Disconnected from invalid user public 45.78.216.136 port 56718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 04:36:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56994: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:36:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<KRovWR1D4Otm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:37:14 host2 sshd[1588925]: Disconnected from invalid user gabriele 45.78.218.119 port 54940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.107.25
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.107.25, lip=66.85.158.91, session=<Jd5+Wx1Dh32d5msZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, session=<U9CEWx1D7jqhI8Fx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:37:11 host2 sshd[1588808]: Disconnected from invalid user arkserver 101.47.142.27 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:39:51 host2 sshd[1592127]: Disconnected from invalid user bitrix 101.47.142.27 port 42562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 04:40:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<gVCZZh1DpIgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 04:41:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<rpphah1DWh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 04:42:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<q3DRbB1D+rVn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-09 04:42:14 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:59362: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-09 04:42:24 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:49446: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:42:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7yELbx1DsCmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 04:46:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<r+Vjex1DQqjRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 04:46:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<o+0Xfh1DmtRA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:50:38 host2 sshd[1606937]: Disconnected from invalid user wjx 45.78.218.119 port 51600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<UWDnjB1DirKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<HLbmjB1DJI8rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:51:58 host2 sshd[1608762]: Disconnected from invalid user user 2.57.121.25 port 27404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 04:52:12 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Pio9kR1DSL5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:53:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<fUNwlR1DOoaxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 04:54:17 host2 sshd[1614095]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 04:54:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Vg7AmB1D0pZCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 04:56:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<YOhloB1DuOxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 04:58:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6e2Epx1DvtkvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:59:27 host2 sshd[1621275]: Disconnected from invalid user user 2.57.121.25 port 25625 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.160
country_id: 3469034
description:
Nov  9 05:00:24 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.44.96.160, lip=66.85.158.91, TLS, session=<zVKrrR1DBKyxLGCg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.91
country_id: 3865483
description:
Nov  9 05:00:45 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.0.184.91, lip=66.85.158.91, TLS, session=<mpzZrh1D1dOKALhb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-09 05:02:55 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:57259: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-09 05:03:26 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:42796: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 05:03:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<flqvuh1DfIBD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 05:04:45 host2 sshd[1627153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 05:09:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<RyEOzx1DAokv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:11:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<64fe1h1DbKhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:13:02 host2 sshd[1636338]: Disconnected from invalid user laci 200.44.190.194 port 47190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:12:10 host2 sshd[1635433]: Disconnected from invalid user min 102.210.148.92 port 34030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:12:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<jNv+2R1D6jWYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-09 05:14:27 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:60124: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-09 05:14:35 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:54204: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:15:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<aMIl4x1DfKGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 05:14:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<vJIW4B1D3s8r4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:16:46 host2 sshd[1640687]: Disconnected from invalid user devuser 200.44.190.194 port 47942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:18:16 host2 sshd[1642266]: Disconnected from invalid user sshuser 102.210.148.92 port 37066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 05:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<uq367R1DELJnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:21:33 host2 sshd[1645746]: Disconnected from invalid user dave 86.107.77.118 port 46912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  9 05:24:17 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, TLS, session=<51klBB5DQNCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:25:27 host2 sshd[1649880]: Disconnected from invalid user ken 43.135.75.196 port 46974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-09 05:25:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (pication) [71.62.34.216]:47668: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:27:04 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6tv6DR5DiItnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:27:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<ttGKDx5DvD0v7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:28:06 host2 sshd[1652608]: Disconnected from invalid user localhost 43.135.75.196 port 51802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:27:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c9obDh5DfORm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:27:08 host2 sshd[1651658]: Disconnected from invalid user ftpuser 86.107.77.118 port 47382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-09 05:28:35 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:28444: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:29:24 host2 sshd[1654566]: Disconnected from invalid user support 43.135.75.196 port 54194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:32:00 host2 sshd[1657587]: Disconnected from invalid user orca 43.135.75.196 port 59048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 05:31:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<VX1bHR5DFuYv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-11-09 05:34:02 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:50096: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-09 05:34:27 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:21251: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Nov  9 05:36:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.224, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mZeCMB5D48TN0h/g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:38:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<qEPgNR5DJqZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:38:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<0TmJNh5D3M9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:40:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<9nLJPB5Dsu1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:41:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<i9enQB5DgAcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 05:46:28 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<BP9OUx5DaMZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:50:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8mskYB5DBFaYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:58 host2 pure-ftpd[1679986]: (?@195.178.110.160) [INFO] New connection from 195.178.110.160


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, session=<HfidYx5DuIHDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 05:52:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<7TgnZx5DyL+l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:51:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, TLS, session=<TfNHZB5DdobDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:54:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<u/NHcB5DNuexiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 05:54:58 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<L7a3cR5DWp1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-11-09 05:55:28 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:47834: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-09 05:55:40 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:44992: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 05:58:55 host2 sshd[1689105]: Disconnected from invalid user lara 62.60.131.157 port 57578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 06:00:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<I2xihh5DVoQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.234
country_id: 3469034
description:
Nov  9 06:00:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training@v-deploy.com>, method=PLAIN, rip=186.209.247.234, lip=66.85.158.91, TLS, session=<gFSAhR5DKbm60ffq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.144.164
country_id: 690791
description:
Nov  9 06:01:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training>, method=PLAIN, rip=37.221.144.164, lip=66.85.158.91, TLS, session=<f4Bthx5DCM8l3ZCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 06:03:46 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2P0qkR5DGMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.125
country_id: 3175395
description:
Nov  9 06:04:15 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.197.8.125, lip=66.85.158.91, TLS, session=<QVcVkh5DQs25xQh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.47
country_id: 2963597
description:
Nov  9 06:04:34 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.106.141.47, lip=66.85.158.91, TLS, session=<bBImkx5Dla1Zao0v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 06:05:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<QpsPlh5DmNJCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 06:15:48 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<8z5DvB5DFLSxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 06:15:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<eIY5uh5DIKo+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.193.34
country_id: 2921044
description:
Nov  9 06:17:39 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.128.193.34, lip=66.85.158.91, session=<xIX+wh5Du0yygMEi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.232.238
country_id: 2921044
description:
Nov  9 06:17:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.232.238, lip=66.85.158.91, session=<zmMLwx5Dfg3RJuju>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-09 06:18:12 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:41398: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 06:20:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<GfeGzR5D2GKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 06:21:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<L6L0zx5DyrlK4fqm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.91
country_id: 6252001
description:
Nov  9 06:23:47 host2 pure-ftpd[1718211]: (?@199.45.155.91) [INFO] New connection from 199.45.155.91


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:24:09 host2 sshd[1718656]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:24:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ptky3R5DXukDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:25:56 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<DR6V4B5D5OQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-11-09 06:27:02 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:38183: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:27:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vojY5h5D1ooDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-09 06:27:12 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:55158: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:28:28 host2 sshd[1723619]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:28:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<1hTa6h5D3KwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:30:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5lzc7x5DULQDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:30:55 host2 sshd[1727060]: Disconnected from invalid user base 43.153.39.178 port 55298 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:31:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<b/Uw9R5DGu0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:33:15 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<WeHG+h5DGJYDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:33:34 host2 sshd[1730297]: Disconnected from invalid user maman 43.153.39.178 port 34508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:34:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<sdPs/R5DSsEDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:34:44 host2 sshd[1731512]: Disconnected from invalid user jjq 43.153.39.178 port 37794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-11-09 06:36:07 dovecot_login authenticator failed for (nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:55462: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-11-09 06:36:18 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:48098: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 06:36:55 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<10/JBx9D2JlnoNQc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:38:55 host2 sshd[1736504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:38:20 host2 sshd[1735962]: Disconnected from invalid user db2inst1 43.153.39.178 port 47676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:40:43 host2 sshd[1738709]: Disconnected from invalid user user 43.153.39.178 port 53894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 06:48:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<hi59Lx9DxNtK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 06:50:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<fPe6OR9Dso5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 06:52:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<BMzVPR9D3NZn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.241.3
country_id: 6252001
description:
Nov  9 06:57:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.12.241.3, lip=66.85.158.92, session=<rg81UR9DWOQUDPED>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-09 06:58:44 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (unper) [68.60.77.128]:34834: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 06:58:57 host2 sshd[1759905]: Disconnected from invalid user user 2.57.121.25 port 41837 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.37
country_id: 3175395
description:
Nov  9 07:00:05 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.37, lip=66.85.158.91, TLS, session=<AzmwWR9DyLDZGrMl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.66
country_id: 298795
description:
Nov  9 07:00:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.66, lip=66.85.158.91, TLS, session=<liHLWh9D2IZfACBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 07:00:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<gOI/XB9Dqrwv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov  9 07:02:31 host2 pure-ftpd[1764871]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-09 07:02:48 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40712: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-11-09 07:02:59 dovecot_login authenticator failed for ([203.124.44.231]) [203.124.44.231]:45825: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:05:21 host2 sshd[1769016]: Disconnected from invalid user s1 193.163.72.91 port 40654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 07:05:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<vbV5bR9D/M9A44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:09:03 host2 sshd[1773168]: Disconnected from invalid user marcus 193.163.72.91 port 40316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:12:51 host2 sshd[1777368]: Disconnected from invalid user cassandra 193.163.72.91 port 46822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.106
country_id: 1880251
description:
Nov  9 07:13:36 host2 sshd[1778178]: Disconnected from invalid user cassandra 45.78.220.106 port 35330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 07:14:24 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<56PTjR9DoIYv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 07:16:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<R5ewlR9DisBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 07:16:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<+xi/lR9DIptCYSpH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  9 07:17:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.91, TLS, session=<e6Pzlx9D9o1ChJl2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.220.106
country_id: 1880251
description:
Nov  9 07:18:42 host2 sshd[1783921]: Disconnected from invalid user ai 45.78.220.106 port 57202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 07:19:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6AfooB9DxuovT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Nov  9 07:25:43 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.89, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ho5mth9DtcLN0h9Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.203.125
country_id: 6252001
description:
Nov  9 07:27:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.203.125, lip=66.85.158.91, session=<C9PyvR9D/LtK68t9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 07:30:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<hu7exh9D/N8+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-09 07:32:04 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:56394: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 07:31:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<ok/xyR9Dco1K4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.26
country_id: 1733045
description:
2025-11-09 07:32:46 dovecot_login authenticator failed for ([49.124.153.26]) [49.124.153.26]:38744: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.135.32
country_id: 1269750
description:
Nov  9 07:36:17 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=143.244.135.32, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Jasr3B9DyN+P9Icg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2025-11-09 07:41:41 dovecot_login authenticator failed for ([49.124.153.8]) [49.124.153.8]:55794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-11-09 07:41:52 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:34352: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-09 07:42:55 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:54885: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-09 07:42:38 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:43112: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-11-09 07:47:25 dovecot_plain authenticator failed for (toiddynal) [96.85.104.2]:37212: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.216.67.37
country_id: 1861060
description:
Nov  9 07:55:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.216.67.37, lip=66.85.158.91, session=<4Q1wHyBDyq4I2EMl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.208
country_id: 3865483
description:
Nov  9 07:55:46 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=186.190.167.208, lip=66.85.158.91, TLS, session=<MTCuICBD6q66vqfQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.131
country_id: 6290252
description:
Nov  9 07:56:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.97.131, lip=66.85.158.91, TLS, session=<Bk7yISBD+71tzmGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 07:58:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<juxSKiBDDNxK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 08:02:46 host2 sshd[1836712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov  9 08:07:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sDOqSiBDktjG6xhl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.146
country_id: 2635167
description:
Nov  9 08:09:01 host2 dovecot[1509044]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.146, lip=66.85.158.92, TLS, session=<pHRFUSBDa9a594mS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 08:13:15 host2 sshd[1849770]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.5.158
country_id: 290557
description:
2025-11-09 08:13:38 dovecot_plain authenticator failed for (symneecon) [5.31.5.158]:35677: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-09 08:13:41 dovecot_plain authenticator failed for (mormalval) [102.53.15.18]:60826: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-09 08:13:20 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:35794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-09 08:13:29 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:55071: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 08:16:12 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50096: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Nov  9 08:26:07 host2 sshd[1865161]: Disconnected from invalid user hugo 103.118.114.22 port 41580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 08:30:31 host2 sshd[1871091]: Disconnected from invalid user jovan 62.60.131.157 port 10032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 08:33:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 22 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<pKODqCBD2jgv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-11-09 08:33:48 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:42059: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.124
country_id: 2186224
description:
2025-11-09 08:33:59 dovecot_login authenticator failed for ([121.73.169.124]) [121.73.169.124]:55910: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:34:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<FzWVqyBD2KEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:35:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9wYKsSBDBNYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:36:14 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<gxibsiBDeuEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:37:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aYLxtSBD8pYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-09 08:38:34 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:53204: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:38:39 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nRA7uyBDXJsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-09 08:38:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46069: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:40:02 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<v7MswCBDDrMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:40:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Y5yhwCBDps4DhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  9 08:40:42 host2 pure-ftpd[1882817]: (?@87.236.176.215) [INFO] New connection from 87.236.176.215


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 08:42:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uEq6xyBDrOpK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 08:47:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<smdm2yBDMgQv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov  9 08:49:47 host2 pure-ftpd[1895049]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:50:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MdCh5iBDMc+TuYVJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.83
country_id: 6252001
description:
Nov  9 08:51:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.83, lip=66.85.158.91, TLS, session=<LDbo6SBD6vzG6xhT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:51:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<xlvS6iBDXPGTuYVJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-09 08:58:20 dovecot_plain authenticator failed for (spinally) [102.53.15.17]:50478: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:58:48 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS, session=<fLlOAyFDUveTuYVJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:59:13 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<fEfHBCFD+p0DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 09:00:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<j3k4CSFDCJg+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:00:43 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<eNEfCiFDDssDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:02:33 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<3Re6ECFDxIQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:04:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<dm9kFiFDYo0DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:04:22 host2 dovecot[1509044]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<VgU6FyFD4rUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:05:55 host2 dovecot[1509044]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<qjXDHCFDlpYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:05:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<LMztGyFDyJoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:06:12 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<QDjHHSFDxN4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.71
country_id: 6252001
description:
Nov  9 09:06:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mVtVHyFDhNQtT89H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Nov  9 09:06:51 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.92, TLS, session=<hfwZICFDtEnAm1p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:07:45 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Nk9JIyFDeLwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  9 09:08:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+SEzJiFDfOvUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-11-09 09:10:11 dovecot_login authenticator failed for (red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:35942: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-09 09:10:36 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:36328: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-09 09:15:53 dovecot_plain authenticator failed for (tuophiprew) [5.32.99.14]:37442: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-09 09:15:55 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (whisopils) [76.145.10.140]:41992: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.33.221
country_id: 6252001
description:
Nov  9 09:18:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.33.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<n7dOSCFDEJIUoyHd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 09:20:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<H55EUCFD3JU+PIOL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.231.116
country_id: 1861060
description:
Nov  9 09:21:57 host2 pure-ftpd[1932471]: (?@165.154.231.116) [INFO] New connection from 165.154.231.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:23:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<I2d1XCFDEtIjy9JW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:24:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fkU3XiFDiPUjy9JW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-09 09:27:16 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:40366: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-09 09:27:26 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:18143: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-09 09:28:58 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:35588: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-09 09:29:13 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:50500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.119.112.180
country_id: 6252001
description:
Nov  9 09:29:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.119.112.180, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5F6FcSFDrqOHd3C0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:31:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS, session=<BcQueCFDMPwjy9JW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.148.189
country_id: 690791
description:
Nov  9 09:32:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.148.189, lip=66.85.158.91, TLS, session=<bAHqeyFD5aUl3ZS9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.159.117
country_id: 99237
description:
Nov  9 09:32:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=65.20.159.117, lip=66.85.158.91, TLS, session=<Ym7NeiFDrKZBFJ91>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.38.104.3
country_id: 3017382
description:
[2025-11-09 09:43:44 +0530] info [cpaneld] 51.38.104.3 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.92
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.92: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-09 09:51:54 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:46970: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-09 09:52:03 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:46914: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.251.41
country_id: 1819730
description:
Nov  9 09:53:27 host2 sshd[1969988]: Disconnected from invalid user alves 152.32.251.41 port 53836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.89.98.120
country_id: 1282988
description:
Nov  9 09:57:54 host2 sshd[1975465]: Disconnected from invalid user talked 120.89.98.120 port 37706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.89.98.120
country_id: 1282988
description:
Nov  9 10:02:24 host2 sshd[1981533]: Disconnected from invalid user pedrito 120.89.98.120 port 39812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 10:06:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<MA1l9iFDlr4v7AMK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.42
country_id: 6252001
description:
Nov  9 10:07:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZT2Q+iFDyc7N0h8q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-09 10:14:52 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:33640: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-09 10:15:03 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:57954: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-11-09 10:15:02 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (noliss) [76.31.164.124]:34686: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 10:19:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<xt/rIyJDOIUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 10:28:09 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<BLS7QiJDWMg+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 10:27:19 host2 sshd[2010781]: Disconnected from invalid user user 2.57.121.25 port 10612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-09 10:27:31 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:40180: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-09 10:27:43 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:50544: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.243.218.218
country_id: 2921044
description:
[2025-11-09 10:35:51 +0530] info [cpaneld] 136.243.218.218 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:14 host2 sshd[2024385]: error: maximum authentication attempts exceeded for root from 91.170.247.160 port 6947 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:14 host2 sshd[2024385]: Disconnecting authenticating user root 91.170.247.160 port 6947: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:21 host2 sshd[2024473]: error: maximum authentication attempts exceeded for invalid user admin from 91.170.247.160 port 7432 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:23 host2 sshd[2024543]: Disconnecting invalid user admin 91.170.247.160 port 8196: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.70
country_id: 2510769
description:
2025-11-09 10:40:27 dovecot_login authenticator failed for (bPpH50rGE) [98.98.171.70]:54337: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.70
country_id: 2510769
description:
2025-11-09 10:41:15 dovecot_login authenticator failed for (siQzbjMK) [98.98.171.70]:57559: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-09 10:48:25 dovecot_plain authenticator failed for (veralic) [65.20.250.163]:56769: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.243.97
country_id: 798544
description:
Nov  9 10:51:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=109.125.243.97, lip=66.85.158.91, TLS, session=<7dbwlSJDqIdtffNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.187
country_id: 953987
description:
Nov  9 10:52:02 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.45.187, lip=66.85.158.91, TLS, session=<bm0ZlyJDhJZmQC27>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-09 10:56:32 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:21190: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-09 10:56:46 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:54598: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 10:58:39 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Z6jBryJD4qY+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:04:41 host2 sshd[2056651]: Disconnected from invalid user branch 101.47.49.171 port 48242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.102
country_id: 3469034
description:
Nov  9 11:12:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.186.197.102, lip=66.85.158.91, TLS, session=<i91M3yJDTpqKusVm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.158
country_id: 2510769
description:
Nov  9 11:11:52 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.143.92.158, lip=66.85.158.91, TLS, session=<Xj4z3iJDANS5j1ye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.118
country_id: 6252001
description:
Nov  9 11:11:59 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.188.118, lip=66.85.158.91, session=<4w+S3yJDyJMs3Lx2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-09 11:15:54 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:42419: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:17:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8kg38iJD+OIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-09 11:16:30 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:59496: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:17:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<VnKO8iJD8IYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-09 11:17:35 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (covalied) [174.59.253.88]:60848: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:18:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Iusc9iJDqoMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:19:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<r+1K+yJDRucDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:19:55 host2 sshd[2074584]: Disconnected from invalid user testuser 101.47.49.171 port 34570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:20:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<W0DG/iJD2NoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:21:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<rvkzAiNDWo8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:22:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rgLtBSNDRJsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:24:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<awS3CiNDwtkDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 11:23:14 host2 sshd[2078544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:24:28 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EcA+DCNDttMDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:24:56 host2 sshd[2080260]: Disconnected from invalid user jayanthi 101.47.49.171 port 33510 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:25:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<UowSECND/MYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 11:31:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<QmLmJiNDNBwv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-09 11:36:06 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:53418: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.30
country_id: 1168579
description:
2025-11-09 11:36:25 dovecot_login authenticator failed for (30.92.zcomnetworks.com.pk) [103.148.92.30]:35134: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-09 11:38:27 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:33177: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-09 11:38:43 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:54213: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 11:45:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<ZcP9VSNDWt8v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 11:45:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<zAuSViNDUNg+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.200
country_id: 6252001
description:
Nov  9 11:56:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.200, lip=66.85.158.91, TLS, session=<KcMLfSNDdOjG6xjI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 11:55:25 host2 sshd[2118150]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 11:57:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57563: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.21.193
country_id: 2077456
description:
[2025-11-09 11:59:27 +0530] info [cpaneld] 209.38.21.193 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-09 12:02:41 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:62479: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-09 12:02:54 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:48638: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.134.161.95
country_id: 1227603
description:
Nov  9 12:08:35 host2 pure-ftpd[2133648]: (?@112.134.161.95) [INFO] New connection from 112.134.161.95


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.140.174
country_id: 2245662
description:
Nov  9 12:10:37 host2 sshd[2136087]: Disconnected from invalid user komatsu 154.125.140.174 port 43113 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.134.161.95
country_id: 1227603
description:
Nov  9 12:14:14 host2 pure-ftpd[2140812]: (?@112.134.161.95) [INFO] New connection from 112.134.161.95


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 12:15:16 host2 sshd[2141954]: Disconnected from invalid user user 2.57.121.25 port 10425 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-09 12:18:21 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:35073: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 12:18:29 host2 sshd[2145425]: Disconnected from invalid user octavio 62.60.131.157 port 56084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2025-11-09 12:18:45 dovecot_login authenticator failed for ([49.124.151.21]) [49.124.151.21]:60492: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov  9 12:25:33 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wnys5iNDi9TN0h/f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:31:04 host2 sshd[2160734]: Disconnected from invalid user sfserver 47.253.53.123 port 38738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:31:27 host2 sshd[2161115]: Disconnected from invalid user zeshan 107.172.151.218 port 59462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:36:09 host2 sshd[2166090]: Disconnected from invalid user oracle 47.253.53.123 port 34756 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.103.133
country_id: 6252001
description:
Nov  9 12:36:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.103.133, lip=66.85.158.92, session=<+p4QDSRDVMgtOGeF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:37:20 host2 sshd[2167373]: Disconnected from invalid user ubuntu 107.172.151.218 port 56722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:38:37 host2 sshd[2168618]: Disconnected from invalid user ts3server 107.172.151.218 port 58318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:40:05 host2 sshd[2170374]: Disconnected from invalid user mary 47.253.53.123 port 46214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:39:59 host2 sshd[2169984]: Disconnected from invalid user ubuntu 107.172.151.218 port 43768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov  9 12:41:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.234, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KUhkICRDXMuTuYTq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Nov  9 12:42:08 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.94, lip=66.85.158.91, TLS, session=<BBT6ISRDGEUtT7Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 12:41:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<9UWEHyRDMrE+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-11-09 12:43:24 dovecot_login authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:49568: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-09 12:43:35 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:55386: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-09 12:44:14 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:59299: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-09 12:44:34 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:37130: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 12:49:58 host2 sshd[2183419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-09 12:52:09 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:60573: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-09 12:51:53 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:33192: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 12:57:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<jrYWWSRDvHsv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-09 12:58:49 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:54793: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-09 12:59:19 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:37609: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-11-09 13:04:50 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  9 13:05:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<IXC2dCRD2L1ChJl7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:05:42 host2 sshd[2203586]: Disconnected from invalid user flussonic 186.209.77.235 port 54549 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-11-09 13:06:56 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:34187: 535 Incorrect authentication data (set_id=tech@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-09 13:07:41 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:54326: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:10:11 host2 sshd[2208691]: Disconnected from invalid user cs2server 186.209.77.235 port 41764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:13:15 host2 sshd[2211981]: Disconnected from invalid user brian 186.209.77.235 port 42647 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Nov  9 13:17:57 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<fe4doSRDEo6Af15N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-09 13:19:09 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:45274: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.2
country_id: 953987
description:
Nov  9 13:18:19 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.2, lip=66.85.158.91, TLS, session=<dgU8oiRDzONmgTkC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.97.6
country_id: 1269750
description:
2025-11-09 13:19:37 dovecot_login authenticator failed for ([182.66.66.113]) [122.185.97.6]:36136: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 13:22:06 host2 sshd[2222523]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.52
country_id: 2635167
description:
2025-11-09 13:25:28 dovecot_plain authenticator failed for ([23.132.164.52]) [23.132.164.52]:60210: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 13:30:05 host2 sshd[2232265]: Disconnected from invalid user isabela 62.60.131.157 port 25988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  9 13:32:33 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<e2RT1iRDyDS4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.159
country_id: 6252001
description:
Nov  9 13:32:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.159, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CPTN1iRDCZtBMQGf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov  9 13:33:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=</tLu1yRD/hdBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov  9 13:33:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS: Connection closed, session=<F3PF2CRDMopBMQGY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-09 13:40:57 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:51946: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-11-09 13:41:32 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:47579: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-09 13:49:31 dovecot_plain authenticator failed for (kafidly) [65.20.148.165]:35708: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-09 13:49:34 dovecot_plain authenticator failed for (patoe) [92.62.243.174]:36660: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.116
country_id: 6252001
description:
Nov  9 13:49:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.116, lip=66.85.158.92, session=<6KzqEyVDwO3G6xh0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 13:56:56 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<T91ZLSVDTuM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.154.205.102
country_id: 2510769
description:
Nov  9 14:02:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.154.205.102, lip=66.85.158.91, TLS, session=<Qho0PyVDzIG5ms1m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.163
country_id: 3469034
description:
Nov  9 14:02:29 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.163, lip=66.85.158.91, TLS, session=<bghSQCVD0Jq7eEij>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:09:17 host2 sshd[2278295]: Disconnected from invalid user liran 152.32.130.118 port 47336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-09 14:09:55 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:58518: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-09 14:10:07 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:36765: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:13:59 host2 sshd[2283265]: Disconnected from invalid user pooja 152.32.134.231 port 45634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:15:36 host2 sshd[2285370]: Disconnected from invalid user wujiawei 152.32.130.118 port 36530 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 14:16:18 host2 sshd[2287178]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:16:35 host2 sshd[2287543]: Disconnected from invalid user admin 152.32.134.231 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:17:52 host2 sshd[2289135]: Disconnected from invalid user user 152.32.134.231 port 44898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:20:34 host2 sshd[2292500]: Disconnected from invalid user herman 152.32.130.118 port 57426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:21:52 host2 sshd[2294124]: Disconnected from invalid user crafty 152.32.130.118 port 56940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov  9 14:29:45 host2 sshd[2304334]: Disconnected from invalid user git 187.251.132.2 port 34422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-09 14:34:06 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:52913: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-09 14:34:18 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:35659: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-09 14:36:02 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (quorec) [68.52.119.193]:36184: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.251.132.2
country_id: 3996063
description:
Nov  9 14:44:01 host2 sshd[2321019]: Disconnected from invalid user vpn 187.251.132.2 port 41570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Nov  9 14:45:07 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.92, TLS, session=<dxrP2SVDfu2TuYQt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-11-09 14:45:41 dovecot_login authenticator failed for ([49.124.153.24]) [49.124.153.24]:45422: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-09 14:46:02 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:43412: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 14:46:24 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<xBhL3iVD9os+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-11-09 14:48:09 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:62468: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 14:48:22 host2 sshd[2326445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-09 14:48:30 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:58547: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-09 14:54:17 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:23955: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-09 14:54:37 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:38204: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-09 15:04:44 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:52528: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-09 15:04:53 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:58046: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:06:47 host2 sshd[2349014]: Disconnected from invalid user jenkins 179.40.112.10 port 49226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Nov  9 15:08:13 host2 sshd[2350552]: Disconnected from invalid user tempuser 106.51.1.63 port 32972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:08:30 host2 sshd[2350840]: Disconnected from invalid user postgres 179.40.112.10 port 53152 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:11:11 host2 sshd[2353969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:11:34 host2 sshd[2354474]: Disconnected from invalid user prtg 179.40.112.10 port 60972 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:11:20 host2 sshd[2354125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-09 15:15:54 dovecot_plain authenticator failed for (unhamon) [64.53.7.231]:54236: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:17:44 host2 sshd[2362732]: Disconnected from invalid user production 179.40.112.10 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:18:54 host2 sshd[2364202]: Disconnected from invalid user git 185.213.164.17 port 36530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-09 15:19:28 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:49197: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-09 15:19:52 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:51244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:20:14 host2 sshd[2365913]: Disconnected from invalid user ali 185.213.164.17 port 54826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:21:05 host2 sshd[2366910]: Disconnected from invalid user openbravo 179.40.112.10 port 56212 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:21:30 host2 sshd[2367380]: Disconnected from invalid user laravel 185.213.164.17 port 45466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.15
country_id: 3175395
description:
Nov  9 15:24:30 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.15.170.15, lip=66.85.158.91, TLS, session=<CZqqZSZDlZG5D6oP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.165
country_id: 953987
description:
Nov  9 15:24:53 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.56.165, lip=66.85.158.91, TLS, session=<263TZiZDnKtmgTil>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.146.204
country_id: 6252001
description:
Nov  9 15:31:50 host2 pure-ftpd[2381508]: (?@146.190.146.204) [INFO] New connection from 146.190.146.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 15:32:18 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56392: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-09 15:38:00 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:58354: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-09 15:38:17 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:38596: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 15:39:55 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<TLmonSZDmtA+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:42:03 host2 sshd[2393030]: Disconnected from invalid user yt 191.210.70.23 port 48797 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:42:43 host2 sshd[2393637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 15:49:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Ki3rvyZDCL8+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-09 15:50:48 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42944: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-09 15:50:58 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:59629: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:54:08 host2 sshd[2408119]: Disconnected from invalid user bpm 116.193.191.104 port 36620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:53:35 host2 sshd[2407247]: Disconnected from invalid user admin 191.210.70.23 port 54537 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:55:44 host2 sshd[2409972]: Disconnected from invalid user git 191.210.70.23 port 47955 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:55:46 host2 sshd[2409986]: Disconnected from invalid user admin 116.193.191.104 port 60072 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.207
country_id: 6252001
description:
Nov  9 16:00:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.207, lip=66.85.158.92, TLS, session=<C9YX5iZDOPCTuYTP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:59:11 host2 sshd[2414755]: Disconnected from invalid user admin 116.193.191.104 port 53166 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Nov  9 16:04:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<KN299SZD7INChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-09 16:05:32 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:33156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-09 16:05:48 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:39029: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-09 16:06:01 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:52662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-09 16:06:13 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:57975: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.21.193
country_id: 2077456
description:
[2025-11-09 16:06:14 +0530] info [cpaneld] 209.38.21.193 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 16:14:42 host2 sshd[2433635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 16:17:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<585yIydD1NQ+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.186
country_id: 226074
description:
Nov  9 16:25:22 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=196.0.107.186, lip=66.85.158.91, TLS, session=<5W4lPydD6p3EAGu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.184.80.147
country_id: 3469034
description:
Nov  9 16:25:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.184.80.147, lip=66.85.158.91, TLS, session=<cyNxQCdD6OctuFCT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.209.118.254
country_id: 953987
description:
Nov  9 16:28:40 host2 sshd[2448214]: Disconnected from invalid user edu 102.209.118.254 port 47832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-09 16:29:41 dovecot_plain authenticator failed for (peters) [50.231.243.28]:53694: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-09 16:31:59 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:33046: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.209.118.254
country_id: 953987
description:
Nov  9 16:32:20 host2 sshd[2453284]: Disconnected from invalid user milan 102.209.118.254 port 49418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-09 16:32:10 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:53354: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2025-11-09 16:42:53 dovecot_login authenticator failed for ([49.124.152.21]) [49.124.152.21]:55566: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-09 16:43:24 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:40046: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-11-09 16:43:24 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:38414: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.202
country_id: 1733045
description:
2025-11-09 16:43:51 dovecot_login authenticator failed for ([49.124.149.202]) [49.124.149.202]:34114: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.38.185
country_id: 290557
description:
2025-11-09 16:46:15 dovecot_plain authenticator failed for (cogonon) [5.31.38.185]:39342: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Nov  9 16:56:01 host2 dovecot[1509044]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS, session=</bDwrSdDDtHLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-11-09 17:05:59 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:60402: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-09 17:07:08 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:41736: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.146.204
country_id: 6252001
description:
[2025-11-09 17:07:28 +0530] info [cpaneld] 146.190.146.204 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 17:09:08 host2 sshd[2498496]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 17:22:37 host2 sshd[2514021]: Disconnected from invalid user user 2.57.121.25 port 10267 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.225
country_id: 1733045
description:
2025-11-09 17:22:44 dovecot_login authenticator failed for ([49.124.152.225]) [49.124.152.225]:53950: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-09 17:22:55 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:37891: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.120
country_id: 953987
description:
Nov  9 17:30:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.64.47.120, lip=66.85.158.91, TLS, session=<wp7bJShDLeRmQC94>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.49
country_id: 953987
description:
Nov  9 17:30:27 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=102.64.42.49, lip=66.85.158.91, TLS, session=<sfu0JyhDtLxmQCox>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-09 17:40:04 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:53948: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.185.40.6
country_id: 617790
description:
2025-11-09 17:39:53 dovecot_login authenticator failed for (host-static-109-185-40-6.moldtelecom.md) [109.185.40.6]:42346: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 17:41:22 host2 sshd[2537624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Nov  9 17:54:54 host2 sshd[2556997]: Disconnected from invalid user ubuntu 203.145.143.163 port 43470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.143.163
country_id: 1269750
description:
Nov  9 17:56:17 host2 sshd[2559144]: Disconnected from invalid user stack 203.145.143.163 port 43940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.136.108
country_id: 130758
description:
Nov  9 17:56:19 host2 sshd[2559129]: Disconnected from invalid user tester 94.182.136.108 port 50852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Nov  9 17:59:07 host2 sshd[2563523]: Disconnected from invalid user git 203.145.143.163 port 44878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-09 18:00:51 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:53642: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-09 18:01:11 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:34092: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.136.108
country_id: 130758
description:
Nov  9 18:01:33 host2 sshd[2566645]: Disconnected from invalid user ming 94.182.136.108 port 7934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.136.108
country_id: 130758
description:
Nov  9 18:03:51 host2 sshd[2569301]: Disconnected from invalid user sshuser 94.182.136.108 port 48580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.136.108
country_id: 130758
description:
Nov  9 18:13:10 host2 sshd[2580967]: Disconnected from invalid user yuki 94.182.136.108 port 60706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 18:13:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<j8oCwyhDLsg+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-11-09 18:23:36 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:41833: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-09 18:24:04 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:59434: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  9 18:29:25 host2 pure-ftpd[2601616]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  9 18:29:33 host2 pure-ftpd[2601748]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.40
country_id: 6252001
description:
Nov  9 18:29:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.40, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5jD0+ihDVsIUQcIo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.64.26
country_id: 1861060
description:
2025-11-09 18:32:09 dovecot_login authenticator failed for 133.232.64.26.static.zoot.jp [133.232.64.26]:45050: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-11-09 18:32:24 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:58691: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 18:36:10 host2 sshd[2609357]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 18:37:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<R85TGClDPqM+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.137
country_id: 1880251
description:
Nov  9 18:56:03 host2 sshd[2633818]: Disconnected from invalid user mariusz 101.47.48.137 port 49284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.63
country_id: 241170
description:
Nov  9 18:57:58 host2 sshd[2635827]: Disconnected from invalid user server 69.5.189.63 port 56268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.63
country_id: 241170
description:
Nov  9 19:00:55 host2 sshd[2640535]: Disconnected from invalid user agotoz 69.5.189.63 port 56458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.22
country_id: 6252001
description:
Nov  9 19:02:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hURVcSlDtMcNWX0W>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.189.63
country_id: 241170
description:
Nov  9 19:02:08 host2 sshd[2641764]: Disconnected from invalid user sammy 69.5.189.63 port 56568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.209.161.182
country_id: 2750405
description:
Nov  9 19:02:36 host2 sshd[2642255]: Disconnected from invalid user gecko 185.209.161.182 port 48558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov  9 19:03:06 host2 sshd[2642822]: Disconnected from invalid user family 118.26.39.178 port 51992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Nov  9 19:02:13 host2 sshd[2641857]: Disconnected from invalid user dzq 111.238.174.6 port 54032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-09 19:04:07 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:12324: 535 Incorrect authentication data (set_id=security)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  9 19:03:09 host2 sshd[2643009]: Disconnected from invalid user wso2 172.200.228.35 port 58872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.202
country_id: 1269750
description:
2025-11-09 19:03:41 dovecot_login authenticator failed for ([125.23.229.32]) [27.123.101.202]:39936: 535 Incorrect authentication data (set_id=security@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.209.161.182
country_id: 2750405
description:
Nov  9 19:04:58 host2 sshd[2645275]: Disconnected from invalid user wso2 185.209.161.182 port 49578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov  9 19:04:46 host2 sshd[2645114]: Disconnected from invalid user jagdish 118.26.39.178 port 45144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.30
country_id: 3175395
description:
Nov  9 19:05:28 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.189.30, lip=66.85.158.91, TLS, session=<DGXseylDi5O50L0e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.232
country_id: 1880251
description:
Nov  9 19:06:02 host2 sshd[2646494]: Disconnected from invalid user ftpusertest 101.47.162.232 port 40876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.255.8.122
country_id: 2623032
description:
Nov  9 19:05:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=194.255.8.122, lip=66.85.158.91, TLS, session=<NBTYeilDOODC/wh6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  9 19:07:56 host2 sshd[2648616]: Disconnected from invalid user vianmj 172.200.228.35 port 51680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Nov  9 19:07:09 host2 sshd[2647806]: Disconnected from invalid user admin 111.238.174.6 port 54832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov  9 19:07:21 host2 sshd[2647976]: Disconnected from invalid user info 102.88.137.80 port 49710 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 19:08:43 host2 sshd[2649560]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.238.16.154
country_id: 6252001
description:
[2025-11-09 19:08:37 +0530] info [cpaneld] 73.238.16.154 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.51.57.170
country_id: 6252001
description:
[2025-11-09 19:08:53 +0530] info [cpaneld] 45.51.57.170 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.4.16
country_id: 6252001
description:
[2025-11-09 19:08:55 +0530] info [cpaneld] 134.228.4.16 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.67.115
country_id: 6252001
description:
[2025-11-09 19:08:30 +0530] info [cpaneld] 174.168.67.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.166.155.118
country_id: 6252001
description:
[2025-11-09 19:08:35 +0530] info [cpaneld] 67.166.155.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.255.156.220
country_id: 6252001
description:
[2025-11-09 19:08:40 +0530] info [whostmgrd] 207.255.156.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.222.202
country_id: 6252001
description:
[2025-11-09 19:08:43 +0530] info [cpaneld] 172.59.222.202 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.69.42.134
country_id: 6252001
description:
Nov  9 19:10:47 host2 sshd[2652060]: Disconnecting authenticating user root 66.69.42.134 port 39508: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.69.42.134
country_id: 6252001
description:
Nov  9 19:10:47 host2 sshd[2652060]: error: maximum authentication attempts exceeded for root from 66.69.42.134 port 39508 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.181
country_id: 1733045
description:
2025-11-09 19:11:20 dovecot_login authenticator failed for ([49.124.159.181]) [49.124.159.181]:55060: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.63
country_id: 241170
description:
Nov  9 19:11:22 host2 sshd[2652860]: Disconnected from invalid user gecko 69.5.189.63 port 57492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.232
country_id: 1880251
description:
Nov  9 19:11:27 host2 sshd[2652849]: Disconnected from invalid user dcm4chee 101.47.162.232 port 57732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-09 19:11:30 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:57263: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  9 19:14:11 host2 sshd[2657439]: Disconnected from invalid user vncuser 172.200.228.35 port 44428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.137
country_id: 1880251
description:
Nov  9 19:17:57 host2 sshd[2661685]: Disconnected from invalid user rachel 101.47.48.137 port 59324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov  9 19:18:43 host2 sshd[2662430]: Disconnected from invalid user celeryuser 101.47.140.146 port 54410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.137
country_id: 1880251
description:
Nov  9 19:20:34 host2 sshd[2664707]: Disconnected from invalid user ubuntu 101.47.48.137 port 46620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-11-09 19:21:39 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:39632: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov  9 19:21:25 host2 sshd[2665751]: Disconnected from invalid user db2admin 101.47.140.146 port 60460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-09 19:22:11 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:42362: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.137
country_id: 1880251
description:
Nov  9 19:23:08 host2 sshd[2667697]: Disconnected from invalid user node1 101.47.48.137 port 42326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov  9 19:26:41 host2 sshd[2671704]: Disconnected from invalid user kira 101.47.140.146 port 58320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov  9 19:34:18 host2 sshd[2681088]: Disconnected from invalid user localhost 101.47.140.146 port 52690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-09 19:40:06 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3307: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.160.172
country_id: 1880251
description:
Nov  9 19:44:09 host2 sshd[2693236]: Disconnected from invalid user ubuntu 101.47.160.172 port 58178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.56.26
country_id: 1269750
description:
2025-11-09 19:46:16 dovecot_login authenticator failed for (nsg-corporate-26.56.187.122.airtel.in) [122.187.56.26]:43588: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-09 19:46:52 dovecot_login authenticator failed for ([128.185.235.110]) [128.185.235.110]:52378: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 19:47:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58184: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-09 19:58:34 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:16910: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-09 19:58:16 dovecot_login authenticator failed for ([152.52.234.232]) [103.251.31.34]:59056: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 20:03:43 host2 sshd[2717063]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.146.204
country_id: 6252001
description:
Nov  9 20:07:55 host2 pure-ftpd[2722251]: (?@146.190.146.204) [INFO] New connection from 146.190.146.204


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 20:15:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<hje3dSpDTrY+PIOJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.103
country_id: 6252001
description:
Nov  9 20:18:07 host2 pure-ftpd[2740044]: (?@135.237.126.103) [INFO] New connection from 135.237.126.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.204.209.203
country_id: 2635167
description:
2025-11-09 20:22:14 dovecot_login authenticator failed for emerald.da.hostns.io [91.204.209.203]:42670: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-09 20:22:53 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:41432: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.225.119
country_id: 6251999
description:
Nov  9 20:24:55 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.225.119, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PL4DmSpDBo2lFuF3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.64.193.135
country_id: 6252001
description:
[2025-11-09 20:26:19 +0530] info [cpaneld] 71.64.193.135 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.191.134.219
country_id: 6252001
description:
[2025-11-09 20:26:44 +0530] info [cpaneld] 207.191.134.219 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.120.249.154
country_id: 6252001
description:
[2025-11-09 20:26:31 +0530] info [cpaneld] 99.120.249.154 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.121.21.93
country_id: 6252001
description:
[2025-11-09 20:26:14 +0530] info [cpaneld] 50.121.21.93 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.242.92.129
country_id: 6252001
description:
[2025-11-09 20:26:17 +0530] info [cpaneld] 76.242.92.129 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.149.250.102
country_id: 6252001
description:
[2025-11-09 20:26:24 +0530] info [whostmgrd] 99.149.250.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.23.70.13
country_id: 6252001
description:
[2025-11-09 20:26:26 +0530] info [cpaneld] 69.23.70.13 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Nov  9 20:33:02 host2 sshd[2760712]: Disconnected from invalid user rashid 197.211.55.20 port 51252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov  9 20:36:59 host2 sshd[2765194]: Disconnected from invalid user user1 161.132.68.222 port 38660 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 20:36:14 host2 sshd[2764410]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Nov  9 20:37:46 host2 sshd[2766072]: Disconnected from invalid user user 197.211.55.20 port 59626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.234
country_id: 3469034
description:
Nov  9 20:39:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=179.189.199.234, lip=66.85.158.91, TLS, session=<tmRzyipDKqezvcfq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Nov  9 20:38:25 host2 sshd[2766765]: Disconnected from invalid user pedro 161.132.68.222 port 57748 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.103
country_id: 798544
description:
Nov  9 20:39:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=195.205.4.103, lip=66.85.158.91, TLS, session=<JpG5yypDQoHDzQRn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.142
country_id: 2635167
description:
Nov  9 20:39:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.142, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<YYCUzipDwdIjy9KO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2025-11-09 20:40:10 dovecot_login authenticator failed for (181-177-9-119.fiberway.com.ar) [181.177.9.119]:51024: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.142
country_id: 2635167
description:
Nov  9 20:40:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.142, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<47bYzypD3vgjy9KO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-09 20:40:29 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:54860: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Nov  9 20:41:10 host2 sshd[2770161]: Disconnected from invalid user wg 161.132.68.222 port 58052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Nov  9 20:42:18 host2 sshd[2771410]: Disconnected from invalid user admin 45.78.221.93 port 58976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-09 20:44:39 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (uncit) [73.13.220.220]:51754: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Nov  9 20:44:54 host2 sshd[2775561]: Disconnected from invalid user vps 45.78.221.93 port 40836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.142
country_id: 2635167
description:
Nov  9 20:47:46 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.142, lip=66.85.158.91, TLS, session=<rJPC6ipDFvIjy9KO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  9 20:52:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<l01Y/SpDpJJBMQG2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  9 20:53:17 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bcN1/ipDMhRBMQG2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.93
country_id: 1880251
description:
Nov  9 20:55:15 host2 sshd[2788655]: Disconnected from invalid user test 45.78.221.93 port 58016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov  9 20:56:25 host2 sshd[2790209]: Disconnected from invalid user postgres 45.78.193.93 port 40736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Nov  9 20:57:19 host2 sshd[2791116]: Disconnected from invalid user mapr 152.32.171.99 port 48766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.111.108.54
country_id: 290557
description:
Nov  9 20:58:30 host2 sshd[2792450]: Disconnected from invalid user guest 83.111.108.54 port 37160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Nov  9 20:58:43 host2 sshd[2792729]: Disconnected from invalid user batman 152.32.171.99 port 37182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.215.218.161
country_id: 1819730
description:
Nov  9 20:58:57 host2 sshd[2794176]: Disconnected from invalid user sales1 125.215.218.161 port 61403 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.114
country_id: 1269750
description:
2025-11-09 21:00:41 dovecot_login authenticator failed for ([59.145.219.185]) [182.95.52.114]:53964: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-09 21:00:54 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45764: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Nov  9 21:01:32 host2 sshd[2797654]: Disconnected from invalid user proxyuser1 74.243.236.86 port 50456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov  9 21:02:52 host2 sshd[2799012]: Disconnected from invalid user redmine 45.78.193.93 port 60346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.175.180
country_id: 1269750
description:
Nov  9 21:02:07 host2 sshd[2798294]: Disconnected from invalid user david 64.227.175.180 port 47976 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.215.218.161
country_id: 1819730
description:
Nov  9 21:02:12 host2 sshd[2798349]: Disconnected from invalid user xue 125.215.218.161 port 34624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.131.169.128
country_id: 6252001
description:
Nov  9 21:03:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.131.169.128, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<YXYCIitD7opog6mA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov  9 21:05:34 host2 sshd[2802656]: Disconnected from invalid user TEST 45.78.193.93 port 42230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Nov  9 21:08:03 host2 sshd[2805675]: Disconnected from invalid user ernawati 152.32.171.99 port 47444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Nov  9 21:08:15 host2 sshd[2805905]: Disconnected from invalid user kkadmin 74.243.236.86 port 42960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.13.43.140
country_id: 3865483
description:
Nov  9 21:09:25 host2 sshd[2807324]: Disconnected from invalid user es 186.13.43.140 port 33986 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.103.231.115
country_id: 6252001
description:
[2025-11-09 21:10:24 +0530] info [cpaneld] 174.103.231.115 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.172.141
country_id: 6252001
description:
[2025-11-09 21:10:36 +0530] info [cpaneld] 35.139.172.141 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.38.185
country_id: 290557
description:
2025-11-09 21:10:37 dovecot_plain authenticator failed for (trumpons) [5.31.38.185]:50457: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.49
country_id: 6252001
description:
[2025-11-09 21:10:38 +0530] info [cpaneld] 172.59.130.49 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.147.25.133
country_id: 6252001
description:
[2025-11-09 21:10:21 +0530] info [cpaneld] 35.147.25.133 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.56.44
country_id: 6252001
description:
[2025-11-09 21:10:30 +0530] info [cpaneld] 76.150.56.44 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.145.66.187
country_id: 6252001
description:
[2025-11-09 21:10:32 +0530] info [whostmgrd] 216.145.66.187 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.96.95.185
country_id: 6252001
description:
[2025-11-09 21:10:33 +0530] info [cpaneld] 98.96.95.185 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.74.149
country_id: 6252001
description:
[2025-11-09 21:11:38 +0530] info [cpaneld] 76.35.74.149 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.172.63.130
country_id: 6252001
description:
[2025-11-09 21:11:48 +0530] info [cpaneld] 71.172.63.130 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.219.245.130
country_id: 6252001
description:
[2025-11-09 21:11:51 +0530] info [cpaneld] 76.219.245.130 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.195.135
country_id: 6252001
description:
[2025-11-09 21:12:03 +0530] info [whostmgrd] 76.150.195.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.162.241
country_id: 6252001
description:
[2025-11-09 21:12:05 +0530] info [cpaneld] 69.117.162.241 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.69.12.7
country_id: 6252001
description:
[2025-11-09 21:12:07 +0530] info [cpaneld] 73.69.12.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.173.64.97
country_id: 6252001
description:
[2025-11-09 21:12:12 +0530] info [cpaneld] 70.173.64.97 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.13.43.140
country_id: 3865483
description:
Nov  9 21:14:10 host2 sshd[2814713]: Disconnected from invalid user openvpn 186.13.43.140 port 34084 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.79.12.113
country_id: 6252001
description:
[2025-11-09 21:14:34 +0530] info [cpaneld] 108.79.12.113 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.32.36
country_id: 6252001
description:
[2025-11-09 21:14:42 +0530] info [cpaneld] 73.205.32.36 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.153.38.184
country_id: 6252001
description:
[2025-11-09 21:14:45 +0530] info [cpaneld] 73.153.38.184 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.212.244.143
country_id: 6252001
description:
[2025-11-09 21:14:43 +0530] info [cpaneld] 216.212.244.143 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.183.80
country_id: 6252001
description:
[2025-11-09 21:14:36 +0530] info [cpaneld] 172.58.183.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.201.189.13
country_id: 6252001
description:
[2025-11-09 21:14:38 +0530] info [cpaneld] 97.201.189.13 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.237.63.120
country_id: 6252001
description:
[2025-11-09 21:14:40 +0530] info [whostmgrd] 68.237.63.120 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov  9 21:15:56 host2 sshd[2816747]: Disconnected from invalid user vendas 45.78.193.93 port 50864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 21:17:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<xqdRUytDtqs+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.13.43.140
country_id: 3865483
description:
Nov  9 21:20:41 host2 sshd[2822628]: Disconnected from invalid user httpd 186.13.43.140 port 43310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.175.180
country_id: 1269750
description:
Nov  9 21:20:47 host2 sshd[2822691]: Disconnected from invalid user kkadmin 64.227.175.180 port 51248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov  9 21:21:07 host2 sshd[2823134]: Disconnected from invalid user mc 45.78.193.93 port 55158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.167.45
country_id: 3469034
description:
Nov  9 21:22:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=187.109.167.45, lip=66.85.158.91, TLS, session=<6s1MZytDB7O7bact>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.156
country_id: 2510769
description:
Nov  9 21:23:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=139.28.190.156, lip=66.85.158.91, TLS, session=<r6Z8aCtDfbCLHL6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.65
country_id: 1733045
description:
2025-11-09 21:23:50 dovecot_login authenticator failed for ([49.124.151.65]) [49.124.151.65]:45002: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-09 21:24:08 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:46110: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-11-09 21:29:13 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:50458: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-09 21:29:28 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:59566: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.175.180
country_id: 1269750
description:
Nov  9 21:29:07 host2 sshd[2833726]: Disconnected from invalid user dev 64.227.175.180 port 55230 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 21:31:04 host2 sshd[2836283]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-09 21:52:20 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:52622: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.147
country_id: 6252001
description:
Nov  9 21:52:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.147, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WkxJ0itDz8+TuYWT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-11-09 21:52:43 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:46073: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.147
country_id: 6252001
description:
Nov  9 21:53:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.147, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<Bcqv1CtDeu2TuYWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Nov  9 21:58:46 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.92, session=<pVSz6CtDLvpAPsUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Nov  9 21:58:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.92, TLS: Connection closed, session=</xp46StDRhpAPsUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.147
country_id: 6252001
description:
Nov  9 22:00:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.147, lip=66.85.158.92, TLS, session=<Fdkq7ytDQOWTuYWT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 22:03:15 host2 sshd[2891904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 22:09:36 host2 sshd[2899311]: Disconnected from invalid user jaren 62.60.131.157 port 59245 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.146.204
country_id: 6252001
description:
[2025-11-09 22:10:24 +0530] info [cpaneld] 146.190.146.204 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-09 22:20:23 dovecot_login authenticator failed for ([136.232.73.130]) [49.37.32.248]:51658: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-09 22:20:34 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:36506: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov  9 22:24:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<HTdjRSxDSBa4affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov  9 22:24:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, TLS: Connection closed, session=<SzEdRixDRLq4affE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.204.27.243
country_id: 6252001
description:
Nov  9 22:26:02 host2 pure-ftpd[2920905]: (?@44.204.27.243) [INFO] New connection from 44.204.27.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.197
country_id: 3469034
description:
Nov  9 22:30:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@agentallianz.com>, method=PLAIN, rip=138.255.206.197, lip=66.85.158.91, TLS, session=<KAZWVyxD/N+K/87F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.107
country_id: 2963597
description:
Nov  9 22:30:21 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.203.49.107, lip=66.85.158.91, TLS, session=<mBimWCxDEZUlyzFr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-09 22:33:41 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:33594: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-09 22:33:53 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:47198: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.235.196
country_id: 6252001
description:
Nov  9 22:34:47 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=206.189.235.196, lip=66.85.158.91, TLS, session=<UhN+aSxDds7OvevE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-09 22:39:45 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (bionom) [196.47.172.253]:57341: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov  9 22:38:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<zmp4eCxDahlAPpzK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2025-11-09 22:41:26 dovecot_login authenticator failed for ([49.125.201.64]) [49.125.201.64]:48964: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-09 22:41:45 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:50191: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.30
country_id: 6252001
description:
Nov  9 22:45:03 host2 pure-ftpd[2947710]: (?@205.210.31.30) [INFO] New connection from 205.210.31.30


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:50:43 host2 sshd[2954784]: Disconnecting authenticating user root 45.15.226.135 port 43512: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:50:43 host2 sshd[2954784]: error: maximum authentication attempts exceeded for root from 45.15.226.135 port 43512 ssh2 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:50:47 host2 sshd[2954827]: error: maximum authentication attempts exceeded for root from 45.15.226.135 port 43836 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:50:47 host2 sshd[2954827]: Disconnecting authenticating user root 45.15.226.135 port 43836: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:50:58 host2 sshd[2955060]: error: maximum authentication attempts exceeded for invalid user admin from 45.15.226.135 port 44492 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.15.226.135
country_id: 617790
description:
Nov  9 22:51:02 host2 sshd[2955168]: Disconnecting invalid user admin 45.15.226.135 port 44702: Too many authentication failures [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.120
country_id: 6252001
description:
Nov  9 22:52:43 host2 pure-ftpd[2957343]: (?@198.235.24.120) [INFO] New connection from 198.235.24.120


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 22:52:47 host2 sshd[2957369]: Disconnected from invalid user latrell 62.60.131.157 port 49389 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 22:57:31 host2 sshd[2964041]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-09 23:02:12 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:61931: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-09 23:03:19 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:37472: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-09 23:02:49 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:60898: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.225
country_id: 1880251
description:
Nov  9 23:03:30 host2 sshd[2973499]: Disconnected from invalid user asad 101.47.163.225 port 45038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.185
country_id: 6252001
description:
Nov  9 23:05:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fJAV2SxDa/FBMQG5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  9 23:06:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hXEs2ixDbNRBMQG2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  9 23:06:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS: Connection closed, session=<+qW32ixD7NNBMQG2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov  9 23:10:56 host2 sshd[2982161]: Disconnected from invalid user arpan 128.1.132.137 port 47592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Nov  9 23:15:53 host2 sshd[2989433]: Disconnected from invalid user ndd 128.1.132.137 port 50292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-09 23:19:57 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (weentrie) [68.193.149.88]:34327: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.195
country_id: 3469034
description:
Nov  9 23:28:25 host2 sshd[3003797]: Disconnected from invalid user appltest 189.47.10.195 port 46706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 23:28:46 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<I7tsKi1DGKs+PIOL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 23:29:22 host2 sshd[3006107]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.225
country_id: 1880251
description:
Nov  9 23:30:09 host2 sshd[3006867]: Disconnected from invalid user fauzi 101.47.163.225 port 50004 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.15
country_id: 2017370
description:
Nov  9 23:37:10 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.15, lip=66.85.158.91, session=<YPKaSC1DLMeyFhgP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 23:39:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<ykCVUC1DTpo+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 23:39:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<K4jvUC1DLuw+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2025-11-09 23:41:50 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:48096: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-09 23:42:00 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:44528: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-09 23:43:11 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:55370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-09 23:43:43 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:47864: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.111
country_id: 6252001
description:
Nov  9 23:45:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.111, lip=66.85.158.91, session=<w/6yZS1DJZ1BMQFv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Nov  9 23:45:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS: Connection closed, session=<30R/Zi1DkINBMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-09 23:50:05 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:33359: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 23:50:20 host2 sshd[3032097]: Disconnected from invalid user user 2.57.121.25 port 12777 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Nov  9 23:55:56 host2 sshd[3038990]: Disconnected from invalid user steam 182.180.59.208 port 52096 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.59.208
country_id: 1168579
description:
Nov  9 23:57:32 host2 sshd[3040498]: Disconnected from invalid user user 182.180.59.208 port 52844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.192
country_id: 690791
description:
Nov  9 23:58:21 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.17.125.192, lip=66.85.158.91, TLS, session=</tdGky1Dsdm5EX3A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.238
country_id: 3175395
description:
Nov  9 23:58:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.170.238, lip=66.85.158.91, TLS, session=<IANtlC1Dc9q5D6ru>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Nov  9 23:59:04 host2 sshd[3043723]: Disconnected from invalid user proxyuser1 182.180.59.208 port 53592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.59.208
country_id: 1168579
description:
Nov 10 00:06:58 host2 sshd[3052547]: Disconnected from invalid user db2inst1 182.180.59.208 port 57340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Nov 10 00:08:37 host2 sshd[3054214]: Disconnected from invalid user ossuser 182.180.59.208 port 58094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 00:10:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64199: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 10 00:09:54 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<cvOkvS1DsKFChJlz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.59.208
country_id: 1168579
description:
Nov 10 00:11:39 host2 sshd[3057852]: Disconnected from invalid user runner 182.180.59.208 port 59596 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-10 00:17:56 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:50318: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-10 00:19:55 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:47412: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-10 00:20:19 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:34504: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-10 00:20:28 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:37336: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.7.72.6
country_id: 130758
description:
Nov 10 00:20:42 host2 sshd[3068822]: Disconnected from invalid user tabata 31.7.72.6 port 61521 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.76.86.29
country_id: 1861060
description:
2025-11-10 00:21:10 dovecot_login authenticator failed for ab086029.ppp.asahi-net.or.jp [183.76.86.29]:26613: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-10 00:22:19 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:48438: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.7.72.6
country_id: 130758
description:
Nov 10 00:23:19 host2 sshd[3071820]: Disconnected from invalid user amir 31.7.72.6 port 31327 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.86.94
country_id: 2750405
description:
2025-11-10 00:25:43 dovecot_login authenticator failed for (8MzNlG) [196.251.86.94]:51779: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.86.94
country_id: 2750405
description:
2025-11-10 00:26:40 dovecot_login authenticator failed for (XHZs4q) [196.251.86.94]:63237: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.86.94
country_id: 2750405
description:
2025-11-10 00:27:26 dovecot_login authenticator failed for (0c8zfkF4qu) [196.251.86.94]:55863: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 00:30:26 host2 sshd[3081338]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.61
country_id: 3175395
description:
Nov 10 00:31:22 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=109.70.204.61, lip=66.85.158.91, TLS, session=<axp0CS5DtZRtRsw9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.152
country_id: 3175395
description:
Nov 10 00:31:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.8.152, lip=66.85.158.91, TLS, session=<xHeACi5Dq9i5xQiY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.244
country_id: 2635167
description:
Nov 10 00:32:36 host2 dovecot[1509044]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.244, lip=66.85.158.92, TLS, session=<NaLMDi5D+cpX7LD0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.3
country_id: 2635167
description:
Nov 10 00:32:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.3, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<UC7aDi5DP8lX7LAD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.5
country_id: 2635167
description:
Nov 10 00:33:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<QofVEC5DvYpX7LAF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.5
country_id: 2635167
description:
Nov 10 00:33:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<BNjQEi5DSYq594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.24
country_id: 2635167
description:
Nov 10 00:34:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.24, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<KlLMFC5D84e594kY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.9
country_id: 2635167
description:
Nov 10 00:34:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.9, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<MMPHFi5Du82594kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.33
country_id: 2635167
description:
Nov 10 00:35:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.33, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WBzBGC5DH6m594kh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.5
country_id: 2635167
description:
Nov 10 00:35:56 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<feO+Gi5Do4dX7LAF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-10 00:36:56 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:48678: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.6
country_id: 2635167
description:
Nov 10 00:37:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.6, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<5lW0Hi5DH62594kG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Nov 10 00:36:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GOS6HC5DI8pX7LAK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-10 00:36:43 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:57435: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.34
country_id: 2635167
description:
Nov 10 00:37:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<ccKvIC5DS9i594ki>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 00:41:07 host2 sshd[3093376]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-11-10 00:44:55 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:33972: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-11-10 00:45:10 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:2242: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-10 00:45:20 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:58461: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov 10 00:47:59 host2 sshd[3103017]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 57951


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.154
country_id: 1733045
description:
2025-11-10 00:52:49 dovecot_login authenticator failed for ([49.124.155.154]) [49.124.155.154]:53978: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-10 00:52:57 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:47050: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 10 00:54:43 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<CiLmXS5DSP7CpRCl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 00:56:50 host2 sshd[3112936]: Disconnected from invalid user roland 62.60.131.157 port 11298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-10 00:58:43 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:39566: 535 Incorrect authentication data (set_id=offers@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-10 00:58:56 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:37952: 535 Incorrect authentication data (set_id=offers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 00:59:28 host2 sshd[3117445]: Disconnected from invalid user roland 62.60.131.157 port 40577 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 01:02:09 host2 sshd[3120489]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.71
country_id: 6252001
description:
Nov 10 01:05:27 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.207.71, lip=66.85.158.92, session=<EFRUhC5Dxp0tT89H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.22.156
country_id: 6252001
description:
Nov 10 01:10:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.22.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<7rIFmC5DxooUHRac>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Nov 10 01:17:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fPXZrS5DI9bN0h83>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.234.92.109
country_id: 6252001
description:
2025-11-10 01:17:56 dovecot_plain authenticator failed for ec2-54-234-92-109.compute-1.amazonaws.com (EC2AMAZ-V5AP00P.ec2.internal) [54.234.92.109]:52741: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-11-10 01:20:29 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:51732: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2025-11-10 01:20:41 dovecot_login authenticator failed for (nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:35774: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.47
country_id: 6252001
description:
Nov 10 01:28:28 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=135.237.126.47, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Nz6e1i5D1sGH7X4v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Nov 10 01:36:35 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.255, lip=66.85.158.92, session=<iACp8y5DzurG6xj/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.179
country_id: 6252001
description:
Nov 10 01:39:29 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.179, lip=66.85.158.91, session=<99sF/i5DmsgtT7Wz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.102
country_id: 1269750
description:
2025-11-10 01:42:04 dovecot_login authenticator failed for ([182.95.54.102]) [182.95.54.102]:45334: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.61
country_id: 1733045
description:
2025-11-10 01:42:36 dovecot_login authenticator failed for ([49.124.151.61]) [49.124.151.61]:46758: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-10 01:44:10 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:35666: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.114.72
country_id: 1210997
description:
2025-11-10 01:43:27 dovecot_login authenticator failed for ([182.160.114.72]) [182.160.114.72]:50174: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.54
country_id: 6252001
description:
Nov 10 01:47:29 host2 pure-ftpd[3176769]: (?@198.235.24.54) [INFO] New connection from 198.235.24.54


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 10 01:52:18 host2 sshd[3182941]: Disconnected from invalid user randy 104.244.74.84 port 47892 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 10 01:52:55 host2 sshd[3183552]: Disconnected from invalid user michael 164.92.106.89 port 33244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 10 01:55:07 host2 sshd[3186712]: Disconnected from invalid user ubuntu 164.92.106.89 port 33806 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 01:56:03 host2 sshd[3187782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 10 01:58:35 host2 sshd[3190660]: Disconnected from invalid user www 104.244.74.84 port 43792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 10 01:59:55 host2 sshd[3193055]: Disconnected from invalid user deployer 104.244.74.84 port 44144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Nov 10 02:01:36 host2 sshd[3195590]: Disconnected from invalid user sammy 158.51.124.122 port 56442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-11-10 02:02:01 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:59035: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-10 02:02:47 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:54470: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.57.242
country_id: 2921044
description:
Nov 10 02:04:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.71.57.242, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<u5bZVS9D6NWnRzny>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.124.122
country_id: 6252001
description:
Nov 10 02:08:37 host2 sshd[3203479]: Disconnected from invalid user smb 158.51.124.122 port 52210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Nov 10 02:10:35 host2 sshd[3205920]: Disconnected from invalid user gustavo 158.51.124.122 port 57718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-11-10 02:16:58 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:37072: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-10 02:17:28 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:38163: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 10 02:17:40 host2 sshd[3215590]: Disconnected from invalid user admin 159.253.36.117 port 54030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2025-11-10 02:20:09 dovecot_login authenticator failed for ([183.171.7.171]) [183.171.7.171]:55084: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.155
country_id: 3865483
description:
Nov 10 02:20:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.238.106.155, lip=66.85.158.91, TLS, session=<LWwnkS9DU9Et7mqb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.141.12
country_id: 1880251
description:
Nov 10 02:20:59 host2 sshd[3219355]: Disconnected from invalid user teamspeak 101.47.141.12 port 40952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.188.250
country_id: 1835841
description:
Nov 10 02:20:18 host2 sshd[3218690]: Disconnected from invalid user db-user 43.155.188.250 port 40268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.6.212
country_id: 3077311
description:
Nov 10 02:20:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=31.222.6.212, lip=66.85.158.91, TLS, session=<i5rNjy9Dt7Qf3gbU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 10 02:21:27 host2 sshd[3219890]: Disconnected from invalid user ubuntu 159.253.36.117 port 38068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.75.6.242
country_id: 3469034
description:
Nov 10 02:21:52 host2 sshd[3220343]: Disconnected from invalid user ftp_user 177.75.6.242 port 11481 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 10 02:22:41 host2 sshd[3221323]: Disconnected from invalid user ftp_user 159.253.36.117 port 52790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.75.6.242
country_id: 3469034
description:
Nov 10 02:23:24 host2 sshd[3222115]: Disconnected from invalid user db-user 177.75.6.242 port 9714 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.253.36.117
country_id: 298795
description:
Nov 10 02:25:03 host2 sshd[3223705]: Disconnected from invalid user oracle 159.253.36.117 port 43310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 02:25:20 host2 sshd[3224194]: Disconnected from invalid user eryn 62.60.131.157 port 14909 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Nov 10 02:25:55 host2 sshd[3224739]: Disconnected from invalid user soksuser 172.214.209.153 port 41176 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 02:27:40 host2 sshd[3226764]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 02:27:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<PP9xqC9DMo8+PIOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.75.6.242
country_id: 3469034
description:
Nov 10 02:28:04 host2 sshd[3227209]: Disconnected from invalid user ventas01 177.75.6.242 port 16083 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.214.209.153
country_id: 6252001
description:
Nov 10 02:30:05 host2 sshd[3231086]: Disconnected from invalid user dummy 172.214.209.153 port 53658 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 10 02:45:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Aqev6S9DL9aTuYTq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 10 02:47:04 host2 pure-ftpd[3250812]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.9
country_id: 1733045
description:
2025-11-10 02:51:36 dovecot_login authenticator failed for ([49.124.153.9]) [49.124.153.9]:45838: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-11-10 02:51:47 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:39972: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.105
country_id: 6252001
description:
Nov 10 02:54:06 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZrXhCDBD7MGTuYRp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.213
country_id: 6252001
description:
Nov 10 03:13:40 host2 pure-ftpd[3282546]: (?@205.210.31.213) [INFO] New connection from 205.210.31.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-10 03:19:45 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:51605: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.80
country_id: 6252001
description:
Nov 10 03:19:57 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.80, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3AJWZTBDj9zG6xhQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-11-10 03:20:39 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:37767: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-10 03:21:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:50851: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 03:21:28 host2 sshd[3292994]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Nov 10 03:27:15 host2 sshd[3299004]: Disconnected from invalid user testftp 152.32.250.188 port 60304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.176.195
country_id: 798544
description:
2025-11-10 03:31:05 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:49972: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.18
country_id: 6252001
description:
Nov 10 03:31:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.18, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Kr4XjzBDOsuTuYQS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-10 03:31:23 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:59998: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.121.215
country_id: 2802361
description:
Nov 10 03:34:22 host2 pure-ftpd[3308074]: (?@35.240.121.215) [INFO] New connection from 35.240.121.215


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.141.25
country_id: 1880251
description:
Nov 10 03:43:38 host2 sshd[3318301]: Disconnected from invalid user srojas 101.47.141.25 port 59322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-10 03:49:30 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:37724: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-10 03:49:49 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:55192: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.195.163
country_id: 99237
description:
Nov 10 03:51:33 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=65.20.195.163, lip=66.85.158.91, TLS, session=<cypS1TBDCadBFMOj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.197
country_id: 3469034
description:
Nov 10 03:51:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.197, lip=66.85.158.91, TLS, session=<RpyX1jBD0cm+WYjF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 03:52:57 host2 sshd[3332887]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.25
country_id: 1880251
description:
Nov 10 03:56:50 host2 sshd[3338150]: Disconnected from invalid user prueba1 101.47.141.25 port 48604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-10 03:58:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:48995: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-10 04:00:57 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:37510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-10 04:02:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:17437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-10 04:04:42 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:52847: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 04:07:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62899: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.15
country_id: 2017370
description:
Nov 10 04:14:20 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.15, lip=66.85.158.92, session=<WvzTJzFDvLuyFhgP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.246.209.88
country_id: 6252001
description:
[2025-11-10 04:14:31 +0530] info [webmaild] 185.246.209.88 - isuru@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:25:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<R2XrTjFDtK0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:27:28 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<PiTIVjFD8NADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:28:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<inY4XDFDRuIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:30:34 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<kBTcYTFD9OQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:31:11 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Xq4MZDFDiOIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:32:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<OR0baTFD6MQDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:32:53 host2 dovecot[1509044]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<xqYoajFDHNIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:34:51 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NropcTFDXs4Dg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:35:07 host2 dovecot[1509044]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<VYAbcjFD9L0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:35:13 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<xhuAcjFDIN0Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-11-10 04:35:16 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:43854: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-10 04:35:27 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:46033: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 10 04:37:24 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<NwlFejFDBK4Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 10 04:40:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0KbYhTFD4/4t4/6c>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 04:46:38 host2 sshd[3416676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.112
country_id: 690791
description:
Nov 10 04:58:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.17.125.112, lip=66.85.158.91, TLS, session=<brTPxTFDe7a5EX1w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.17
country_id: 3469034
description:
Nov 10 04:58:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.130.170.17, lip=66.85.158.91, TLS, session=<6mV/xDFDM5SxgqoR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 10 05:04:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.91, TLS: Connection closed, session=<ZDrY2zFDFr9ChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-11-10 05:07:24 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:51059: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-11-10 05:07:44 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:43078: 535 Incorrect authentication data (set_id=charanaw)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 166.88.101.185
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 166.88.101.185: 316 connections per 30 seconds to 587 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 166.88.101.185
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 166.88.101.185: 304 connections per 30 seconds to 587 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-10 05:12:06 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:39105: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-10 05:13:40 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:49158: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.252
country_id: 1733045
description:
2025-11-10 05:14:40 dovecot_login authenticator failed for ([49.124.150.252]) [49.124.150.252]:59800: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 05:18:14 host2 sshd[3458277]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.16.108.146
country_id: 6290252
description:
Nov 10 05:19:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=46.16.108.146, lip=66.85.158.91, TLS, session=<5uftEDJDR+kuEGyS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.73.3
country_id: 3469034
description:
Nov 10 05:20:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=138.97.73.3, lip=66.85.158.91, TLS, session=<1V4REjJDYtKKYUkD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-10 05:25:54 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:35724: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.71
country_id: 1269750
description:
2025-11-10 05:26:13 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.71]:34572: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 10 05:31:10 host2 sshd[3474909]: Disconnected from invalid user runner 213.55.85.202 port 2864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.95.119.106
country_id: 798544
description:
Nov 10 05:31:59 host2 sshd[3475725]: Disconnected from invalid user oracle 93.95.119.106 port 53740 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.173.214
country_id: 2921044
description:
Nov 10 05:32:06 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.90.173.214, lip=66.85.158.92, TLS, session=</ennPTJDfsqkWq3W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 10 05:31:37 host2 sshd[3475352]: Disconnected from invalid user test 20.127.224.153 port 51578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.223.98.115
country_id: 2510769
description:
Nov 10 05:32:00 host2 sshd[3475733]: Disconnected from invalid user runner 82.223.98.115 port 54904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.248.187
country_id: 3017382
description:
Nov 10 05:31:41 host2 sshd[3475379]: Disconnected from invalid user devops 62.60.248.187 port 46252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.185.162
country_id: 6252001
description:
Nov 10 05:32:47 host2 sshd[3476581]: Disconnected from invalid user stephen 74.208.185.162 port 53904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 10 05:32:57 host2 sshd[3476705]: Disconnected from invalid user user 40.117.97.0 port 35718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 10 05:32:27 host2 sshd[3476243]: Disconnected from invalid user admin 107.150.20.228 port 57568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 10 05:32:36 host2 sshd[3476316]: Disconnected from invalid user user_01 196.196.253.20 port 36012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.95.119.106
country_id: 798544
description:
Nov 10 05:34:10 host2 sshd[3477940]: Disconnected from invalid user alex 93.95.119.106 port 38430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 10 05:34:29 host2 sshd[3478116]: Disconnected from invalid user splunk 52.169.142.214 port 59016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.165.252.106
country_id: 2750405
description:
Nov 10 05:34:43 host2 sshd[3478388]: Disconnected from invalid user splunk 213.165.252.106 port 44994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.159
country_id: 6252001
description:
Nov 10 05:35:09 host2 sshd[3479099]: Disconnected from invalid user vitor 199.195.251.159 port 63558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 10 05:34:12 host2 sshd[3477979]: Disconnected from invalid user centos 40.115.18.231 port 44706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.227.108.149
country_id: 2921044
description:
Nov 10 05:34:20 host2 sshd[3478067]: Disconnected from invalid user vitor 185.227.108.149 port 51730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.158.211.7
country_id: 2750405
description:
Nov 10 05:34:37 host2 sshd[3478358]: Disconnected from invalid user alex 93.158.211.7 port 43162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Nov 10 05:35:10 host2 sshd[3479121]: Disconnected from invalid user deploy 72.144.12.31 port 58296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.158.211.7
country_id: 2750405
description:
Nov 10 05:35:58 host2 sshd[3480050]: Disconnected from invalid user centos 93.158.211.7 port 60412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Nov 10 05:36:00 host2 sshd[3480080]: Disconnected from invalid user user_01 24.144.124.91 port 41112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.223.98.115
country_id: 2510769
description:
Nov 10 05:35:22 host2 sshd[3479302]: Disconnected from invalid user dolphin 82.223.98.115 port 53948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.185.122
country_id: 1269750
description:
Nov 10 05:35:40 host2 sshd[3479614]: Disconnected from invalid user sshuser 64.227.185.122 port 50214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 10 05:35:20 host2 sshd[3479294]: Disconnected from invalid user splunk 172.190.117.128 port 56686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 10 05:35:40 host2 sshd[3479626]: Disconnected from invalid user root1 158.69.194.34 port 36054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Nov 10 05:35:13 host2 sshd[3479150]: Disconnected from invalid user postgres 34.91.0.68 port 36178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.131.35.253
country_id: 6252001
description:
Nov 10 05:35:34 host2 sshd[3479571]: Disconnected from invalid user oxidized 3.131.35.253 port 52398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.135
country_id: 130758
description:
Nov 10 05:36:22 host2 sshd[3480525]: Disconnected from invalid user stephen 185.50.38.135 port 37484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Nov 10 05:36:27 host2 sshd[3480576]: Disconnected from invalid user betty 72.144.12.31 port 42720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.94.253
country_id: 2921044
description:
Nov 10 05:36:53 host2 sshd[3480992]: Disconnected from invalid user user 64.226.94.253 port 55292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 10 05:36:35 host2 sshd[3480648]: Disconnected from invalid user kn 20.102.116.25 port 50634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.15
country_id: 241170
description:
Nov 10 05:37:13 host2 sshd[3481565]: Disconnected from invalid user william 154.91.170.15 port 37594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 10 05:37:37 host2 sshd[3481934]: Disconnected from invalid user ssm 20.185.243.158 port 59850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.11.189
country_id: 2750405
description:
Nov 10 05:37:49 host2 sshd[3482071]: Disconnected from invalid user player 167.71.11.189 port 54104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 10 05:37:53 host2 sshd[3482101]: Disconnected from invalid user wy 104.223.85.124 port 42002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.251.115.80
country_id: 2750405
description:
Nov 10 05:38:00 host2 sshd[3482252]: Disconnected from invalid user lai 196.251.115.80 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 10 05:37:44 host2 sshd[3481996]: Disconnected from invalid user admin 20.123.120.169 port 51646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 10 05:37:46 host2 sshd[3482031]: Disconnected from invalid user alex 196.196.253.20 port 36510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Nov 10 05:37:52 host2 sshd[3482085]: Disconnected from invalid user devops 72.144.12.31 port 37658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.47.55.132
country_id: 130758
description:
Nov 10 05:38:11 host2 sshd[3482581]: Disconnected from invalid user root1 31.47.55.132 port 57496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 10 05:38:18 host2 sshd[3482702]: Disconnected from invalid user test 137.184.111.54 port 40020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 10 05:38:15 host2 sshd[3482615]: Disconnected from invalid user vijay 143.58.211.64 port 38472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 10 05:38:15 host2 sshd[3482621]: Disconnected from invalid user administrador 213.55.85.202 port 2867 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 10 05:38:29 host2 sshd[3482985]: Disconnected from invalid user kn 52.169.142.214 port 41910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.251.115.80
country_id: 2750405
description:
Nov 10 05:39:06 host2 sshd[3483644]: Disconnected from invalid user user_01 196.251.115.80 port 55424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 10 05:38:57 host2 sshd[3483415]: Disconnected from invalid user centos 20.102.116.25 port 39896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 10 05:40:07 host2 sshd[3484864]: Disconnected from invalid user andrew 41.82.208.178 port 38560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 10 05:39:29 host2 sshd[3484048]: Disconnected from invalid user alex 125.21.53.232 port 37704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Nov 10 05:39:57 host2 sshd[3484481]: Disconnected from invalid user student5 137.184.145.163 port 55012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 99.79.193.171
country_id: 6251999
description:
Nov 10 05:39:36 host2 sshd[3484120]: Disconnected from invalid user oracle 99.79.193.171 port 38378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.53.204
country_id: 1269750
description:
Nov 10 05:40:28 host2 sshd[3485288]: Disconnected from invalid user oracle 20.197.53.204 port 58996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 10 05:40:17 host2 sshd[3485143]: Disconnected from invalid user student5 137.184.202.107 port 59296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Nov 10 05:40:20 host2 sshd[3485195]: Disconnected from invalid user kn 45.81.23.49 port 53930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Nov 10 05:40:22 host2 sshd[3485228]: Disconnected from invalid user siteadmin 54.38.52.18 port 60218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 99.79.193.171
country_id: 6251999
description:
Nov 10 05:40:51 host2 sshd[3485804]: Disconnected from invalid user administrador 99.79.193.171 port 36712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.94.253
country_id: 2921044
description:
Nov 10 05:41:07 host2 sshd[3486357]: Disconnected from invalid user admin 64.226.94.253 port 41238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 10 05:41:08 host2 sshd[3486355]: Disconnected from invalid user runner 185.164.73.248 port 36810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.185.122
country_id: 1269750
description:
Nov 10 05:42:01 host2 sshd[3487588]: Disconnected from invalid user dolphin 64.227.185.122 port 34836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Nov 10 05:42:02 host2 sshd[3487696]: Disconnected from invalid user ssm 24.144.124.91 port 40924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.202.201
country_id: 6252001
description:
Nov 10 05:41:16 host2 sshd[3486560]: Disconnected from invalid user alex 206.189.202.201 port 38648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 10 05:42:09 host2 sshd[3487935]: Disconnected from invalid user alex 104.223.85.124 port 53078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.12.40.251
country_id: 130758
description:
Nov 10 05:42:05 host2 sshd[3487809]: Disconnected from invalid user wy 81.12.40.251 port 41664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 10 05:41:42 host2 sshd[3487159]: Disconnected from invalid user user 196.196.253.20 port 36952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.11.189
country_id: 2750405
description:
Nov 10 05:43:04 host2 sshd[3488920]: Disconnected from invalid user deploy 167.71.11.189 port 44532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.53.204
country_id: 1269750
description:
Nov 10 05:43:07 host2 sshd[3488940]: Disconnected from invalid user wy 20.197.53.204 port 35554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 10 05:42:32 host2 sshd[3488360]: Disconnected from invalid user wy 158.69.194.34 port 38278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 10 05:42:21 host2 sshd[3488121]: Disconnected from invalid user dolphin 213.55.85.202 port 2870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-11-10 05:42:43 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:52310: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-11-10 05:43:09 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:37944: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.225.214
country_id: 2635167
description:
Nov 10 05:43:23 host2 sshd[3489324]: Disconnected from invalid user centos 45.8.225.214 port 35290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.165.252.106
country_id: 2750405
description:
Nov 10 05:43:43 host2 sshd[3489616]: Disconnected from invalid user user 213.165.252.106 port 50302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Nov 10 05:43:55 host2 sshd[3490299]: Disconnected from invalid user player 72.144.12.31 port 52822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 10 05:43:16 host2 sshd[3489237]: Disconnected from invalid user ssm 51.77.149.244 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.219.74.98
country_id: 130758
description:
Nov 10 05:43:19 host2 sshd[3489270]: Disconnected from invalid user visitor 217.219.74.98 port 50066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.174.209
country_id: 2750405
description:
Nov 10 05:43:25 host2 sshd[3489333]: Disconnected from invalid user vijay 185.213.174.209 port 54928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 10 05:43:35 host2 sshd[3489401]: Disconnected from invalid user root1 185.50.38.171 port 33420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.184.18.33
country_id: 130758
description:
Nov 10 05:44:02 host2 sshd[3491352]: Disconnected from invalid user siteadmin 94.184.18.33 port 54560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 10 05:44:43 host2 sshd[3492237]: Disconnected from invalid user siteadmin 51.77.149.244 port 56358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Nov 10 05:45:09 host2 sshd[3492950]: Disconnected from invalid user deploy 54.38.52.18 port 56248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.225.214
country_id: 2635167
description:
Nov 10 05:44:50 host2 sshd[3492341]: Disconnected from invalid user splunk 45.8.225.214 port 47560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.219.74.98
country_id: 130758
description:
Nov 10 05:44:33 host2 sshd[3492036]: Disconnected from invalid user test 217.219.74.98 port 57708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Nov 10 05:44:13 host2 sshd[3491784]: Disconnected from invalid user visitor 137.184.145.163 port 53154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.15
country_id: 241170
description:
Nov 10 05:46:13 host2 sshd[3494556]: Disconnected from invalid user centos 154.91.170.15 port 58570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 10 05:45:28 host2 sshd[3493718]: Disconnected from invalid user minecraft 213.55.85.202 port 2872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.174.209
country_id: 2750405
description:
Nov 10 05:45:29 host2 sshd[3493734]: Disconnected from invalid user admin 185.213.174.209 port 49904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 10 05:45:18 host2 sshd[3493509]: Disconnected from invalid user visitor 158.69.194.34 port 33958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.85.209
country_id: 6252001
description:
Nov 10 05:45:20 host2 sshd[3493567]: Disconnected from invalid user stephen 107.173.85.209 port 47092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 10 05:45:39 host2 sshd[3493943]: Disconnected from invalid user test 137.184.202.107 port 34154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.202.201
country_id: 6252001
description:
Nov 10 05:46:35 host2 sshd[3495049]: Disconnected from invalid user runner 206.189.202.201 port 48738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Nov 10 05:46:54 host2 sshd[3495358]: Disconnected from invalid user alex 213.55.85.202 port 2873 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Nov 10 05:46:58 host2 sshd[3495415]: Disconnected from invalid user alex 158.69.210.167 port 36942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.225.214
country_id: 2635167
description:
Nov 10 05:46:22 host2 sshd[3494895]: Disconnected from invalid user ssm 45.8.225.214 port 39762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.33
country_id: 130758
description:
Nov 10 05:46:25 host2 sshd[3494915]: Disconnected from invalid user user_01 94.184.18.33 port 36296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.181.66.85
country_id: 798544
description:
Nov 10 05:48:05 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.181.66.85, lip=66.85.158.91, TLS, session=<F4cTdjJDzQ7CtUJV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Nov 10 05:47:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<EW65dDJDqqyxgqgd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.8.225.214
country_id: 2635167
description:
Nov 10 05:48:06 host2 sshd[3496865]: Disconnected from invalid user admin 45.8.225.214 port 37100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 10 05:49:10 host2 sshd[3498143]: Disconnected from invalid user visitor 137.184.111.54 port 33664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.219.74.98
country_id: 130758
description:
Nov 10 05:48:18 host2 sshd[3497050]: Disconnected from invalid user oracle 217.219.74.98 port 59454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.199.128.27
country_id: 2658434
description:
Nov 10 05:48:38 host2 sshd[3497537]: Disconnected from invalid user splunk 20.199.128.27 port 45510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.53.204
country_id: 1269750
description:
Nov 10 05:48:41 host2 sshd[3497578]: Disconnected from invalid user minecraft 20.197.53.204 port 46540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 10 05:49:06 host2 sshd[3498117]: Disconnected from invalid user root1 185.164.73.248 port 57788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 10 05:50:11 host2 sshd[3499326]: Disconnected from invalid user dolphin 41.33.225.154 port 55480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 10 05:50:15 host2 sshd[3499446]: Disconnected from invalid user root1 137.184.111.54 port 39732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.12.40.251
country_id: 130758
description:
Nov 10 05:50:47 host2 sshd[3500035]: Disconnected from invalid user oxidized 81.12.40.251 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Nov 10 05:51:49 host2 sshd[3501098]: Disconnected from invalid user kn 157.230.211.219 port 38316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.12.40.251
country_id: 130758
description:
Nov 10 05:54:34 host2 sshd[3504528]: Disconnected from invalid user administrador 81.12.40.251 port 55884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.16
country_id: 6252001
description:
Nov 10 05:55:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=20.65.194.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<U/hwkDJDNK0UQcIQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 10 05:54:14 host2 sshd[3503771]: Disconnected from invalid user runner 185.50.38.171 port 41438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.1.108
country_id: 6252001
description:
Nov 10 05:54:21 host2 sshd[3504181]: Disconnected from invalid user administrador 107.172.1.108 port 47480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.1
country_id: 6252001
description:
Nov 10 05:56:55 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.1, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cEGnljJD6JcUqwgB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov 10 05:59:41 host2 sshd[3511612]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 60726


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.57.188.135
country_id: 2635167
description:
[2025-11-10 05:59:50 +0530] info [cpaneld] 31.57.188.135 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov 10 06:00:31 host2 sshd[3512764]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 53330


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.57.188.135
country_id: 2635167
description:
[2025-11-10 06:00:33 +0530] info [cpaneld] 31.57.188.135 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov 10 06:01:36 host2 sshd[3514231]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 51636


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.57.188.135
country_id: 2635167
description:
[2025-11-10 06:01:44 +0530] info [cpaneld] 31.57.188.135 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.12.40.251
country_id: 130758
description:
Nov 10 06:01:58 host2 sshd[3514663]: Disconnected from invalid user runner 81.12.40.251 port 54962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-10 06:04:32 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:52404: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-10 06:04:52 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:35300: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 06:07:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<dGCcvDJDap0+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.165.252.106
country_id: 2750405
description:
Nov 10 06:11:07 host2 sshd[3525859]: Disconnected from invalid user vitor 213.165.252.106 port 46264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.188.135
country_id: 2635167
description:
Nov 10 06:12:06 host2 sshd[3526799]: Invalid user cloudtourssrilan_travel from 31.57.188.135 port 50281


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 06:12:00 host2 sshd[3526672]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.165.252.106
country_id: 2750405
description:
Nov 10 06:13:12 host2 sshd[3528017]: Disconnected from invalid user betty 213.165.252.106 port 37002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.85.209
country_id: 6252001
description:
Nov 10 06:15:55 host2 sshd[3532940]: Disconnected from invalid user oxidized 107.173.85.209 port 43014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.95
country_id: 6252001
description:
Nov 10 06:21:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.95, lip=66.85.158.92, TLS: Connection closed, session=<WJ537TJDmJfHLZtf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-11-10 06:23:19 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:51346: 535 Incorrect authentication data (set_id=legal@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.219
country_id: 6252001
description:
Nov 10 06:24:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.219, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<T3xg+DJDMsOTuYTb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-10 06:27:13 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:45366: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-10 06:27:22 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:42986: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.165.252.106
country_id: 2750405
description:
Nov 10 06:30:06 host2 sshd[3549555]: Disconnected from invalid user lai 213.165.252.106 port 51380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 06:30:23 host2 sshd[3549880]: Disconnected from invalid user randi 62.60.131.157 port 9247 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 06:32:34 host2 sshd[3552127]: Disconnected from invalid user randi 62.60.131.157 port 9861 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 06:33:23 host2 sshd[3553102]: Disconnected from invalid user user 2.57.121.25 port 35857 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Nov 10 06:36:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.43.33.218, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HC7LIzND4cYtKyHa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 06:36:26 host2 sshd[3556430]: Disconnected from invalid user user 2.57.121.25 port 55490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov 10 06:40:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MGDFMDNDaP4t4/6b>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 06:43:39 host2 sshd[3563959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.8
country_id: 3175395
description:
Nov 10 06:49:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.197.9.8, lip=66.85.158.91, TLS, session=<M2SRUDNDpaO5xQkI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.166.154
country_id: 3469034
description:
Nov 10 06:49:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.86.166.154, lip=66.85.158.91, TLS, session=<gg24UTNDXoaxVqaa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-11-10 06:50:39 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:46498: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-10 06:50:50 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:54478: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 10 06:53:28 host2 sshd[3577106]: Disconnected from invalid user fy 122.53.133.167 port 48578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 10 06:57:17 host2 sshd[3581830]: Disconnected from invalid user lighthouse 122.53.133.167 port 46962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.230.34
country_id: 1269750
description:
Nov 10 07:00:36 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=122.187.230.34, lip=66.85.158.91, TLS, session=<yFnxeDNDaNZ6u+Yi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.227.167
country_id: 1269750
description:
Nov 10 07:00:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=122.187.227.167, lip=66.85.158.91, TLS, session=<crqLejND18t6u+On>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 10 07:03:20 host2 sshd[3590091]: Disconnected from invalid user user4 122.53.133.167 port 49798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.247.173.173
country_id: 298795
description:
Nov 10 07:04:29 host2 sshd[3591729]: Disconnected from invalid user devops 104.247.173.173 port 42554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 10 07:06:19 host2 sshd[3593693]: Disconnected from invalid user userb 122.53.133.167 port 51198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-10 07:08:25 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:39936: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-10 07:08:26 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:48286: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.122.170
country_id: 2661886
description:
2025-11-10 07:08:50 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:57270: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-10 07:08:52 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:53656: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.217.93.210
country_id: 6251999
description:
Nov 10 07:09:55 host2 sshd[3597374]: Disconnected from invalid user admin 209.217.93.210 port 35530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.247.173.173
country_id: 298795
description:
Nov 10 07:09:39 host2 sshd[3597078]: Disconnected from invalid user kubeadmin 104.247.173.173 port 55456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.247.173.173
country_id: 298795
description:
Nov 10 07:10:56 host2 sshd[3598778]: Disconnected from invalid user user 104.247.173.173 port 51846 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.190.233.241
country_id: 3175395
description:
[2025-11-10 07:11:26 +0530] info [cpaneld] 85.190.233.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.217.93.210
country_id: 6251999
description:
Nov 10 07:12:30 host2 sshd[3600579]: Disconnected from invalid user oleg 209.217.93.210 port 44422 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.217.93.210
country_id: 6251999
description:
Nov 10 07:13:54 host2 sshd[3602408]: Disconnected from invalid user newuser 209.217.93.210 port 48878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.217.93.210
country_id: 6251999
description:
Nov 10 07:15:24 host2 sshd[3605438]: Disconnected from invalid user yujie 209.217.93.210 port 53336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.12.84.15
country_id: 1269750
description:
Nov 10 07:19:47 host2 sshd[3610539]: Disconnected from invalid user jenkins 61.12.84.15 port 44664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 10 07:19:51 host2 sshd[3610582]: Disconnected from invalid user remoteuser 203.150.107.244 port 50044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 10 07:22:05 host2 sshd[3613167]: Disconnected from invalid user emqx 152.32.129.140 port 17642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 10 07:22:38 host2 sshd[3613709]: Disconnected from invalid user av 46.24.47.94 port 49812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 10 07:23:28 host2 sshd[3614566]: Disconnected from invalid user admin1 152.32.129.140 port 49680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Nov 10 07:24:03 host2 sshd[3615216]: Disconnected from invalid user guille 36.91.81.195 port 49636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 10 07:25:20 host2 sshd[3616825]: Disconnected from invalid user jay 203.150.107.244 port 36814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Nov 10 07:25:41 host2 sshd[3617100]: Disconnected from invalid user av 36.91.81.195 port 53082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 10 07:26:12 host2 sshd[3617719]: Disconnected from invalid user moein 152.32.129.140 port 58766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 10 07:26:31 host2 sshd[3618005]: Disconnected from invalid user jairo 46.24.47.94 port 53436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 10 07:28:06 host2 sshd[3620230]: Disconnected from invalid user backuppc 203.150.107.244 port 37268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-10 07:27:39 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:58563: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.12.84.15
country_id: 1269750
description:
Nov 10 07:27:52 host2 sshd[3619815]: Disconnected from invalid user shivam 61.12.84.15 port 54298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 10 07:27:58 host2 sshd[3619989]: Disconnected from invalid user guille 46.24.47.94 port 54636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-11-10 07:27:29 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:34116: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 10 07:31:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<wiSo6TND7JmLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 07:34:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59975: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 07:37:33 host2 sshd[3632089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-10 07:38:14 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:46216: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-10 07:44:38 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:59659: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-10 07:44:52 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:42304: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 07:45:25 host2 dovecot[1509044]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<oK21GjRDfrFHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 07:45:26 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<9CbBGjRDArVHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-10 07:46:49 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:62327: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-10 07:46:21 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:42069: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-11-10 07:46:33 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:44201: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 07:51:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<V4WBLzRDXKs+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-10 07:56:11 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:41800: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-10 07:55:29 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:60436: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 08:09:15 host2 sshd[3674386]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 10 08:09:35 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<uxEdcTRDdKFChJlw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.27
country_id: 953987
description:
Nov 10 08:11:57 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.129.55.27, lip=66.85.158.91, TLS, session=<6yFTeDRDKu1mgTcb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 08:18:11 host2 sshd[3688712]: Disconnected from invalid user user 2.57.121.25 port 19657 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 10 08:23:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rOwxozRDGrxChJlw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 10 08:26:47 host2 pure-ftpd[3698511]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-10 08:27:03 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:38422: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-11-10 08:27:29 dovecot_login authenticator failed for ([41.224.62.206]) [41.224.62.206]:49417: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.62.8.90
country_id: 1643084
description:
Nov 10 08:33:12 host2 sshd[3707316]: Disconnected from invalid user tezos 202.62.8.90 port 55376 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.57
country_id: 6252001
description:
Nov 10 08:35:22 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+0RZzTRDDsws3Lw5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Nov 10 08:36:27 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.54, lip=66.85.158.92, TLS, session=<Dqoy0TRDUOzN0h82>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-11-10 08:44:58 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:60997: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-10 08:44:46 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:35104: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.62.8.90
country_id: 1643084
description:
Nov 10 08:50:22 host2 sshd[3731285]: Disconnected from invalid user ubuntu 202.62.8.90 port 54772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 08:59:09 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LyVpIjVDF8Gi2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 08:59:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2S8JJTVDLOKi2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:00:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<GPzyJjVDQuii2JZf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 09:03:08 host2 sshd[3748443]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.67
country_id: 298795
description:
Nov 10 09:06:30 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=95.0.171.67, lip=66.85.158.91, TLS, session=<iLKeOzVDM6VfAKtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:06:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS, session=<24liPTVD3Oui2JZf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.254
country_id: 953987
description:
Nov 10 09:06:52 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.34.254, lip=66.85.158.91, TLS, session=<aljLPDVDD7xmQCL+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Nov 10 09:07:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.91, TLS, session=<yco5QDVDbuKi2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:10:24 host2 sshd[3757368]: Disconnected from invalid user deploy 103.59.200.5 port 48312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:13:26 host2 sshd[3760961]: Disconnected from invalid user teamspeak 103.59.200.5 port 47112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-10 09:17:07 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:32856: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-10 09:16:33 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59216: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.200.5
country_id: 1269750
description:
Nov 10 09:16:40 host2 sshd[3766649]: Disconnected from invalid user nb 103.59.200.5 port 53562 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.204
country_id: 6252001
description:
Nov 10 09:21:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.204, lip=66.85.158.91, session=<s/khcTVDhOTN0h/M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-10 09:21:49 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:36187: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-10 09:21:56 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:52215: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-10 09:24:07 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:33422: 535 Incorrect authentication data (set_id=feedback@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.52
country_id: 1733045
description:
2025-11-10 09:24:21 dovecot_login authenticator failed for ([49.124.153.52]) [49.124.153.52]:36478: 535 Incorrect authentication data (set_id=feedback)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 09:34:51 host2 sshd[3790019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 10 09:36:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<6ZQ1pjVDnMo+PIOJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.175.19.145
country_id: 6252001
description:
Nov 10 09:39:55 host2 sshd[3796020]: Disconnected from invalid user db 172.175.19.145 port 60904 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.121.46.95
country_id: 6252001
description:
Nov 10 09:42:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.121.46.95, lip=66.85.158.92, session=<scxDvDVDfLAUeS5f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.175.19.145
country_id: 6252001
description:
Nov 10 09:44:10 host2 sshd[3802425]: Disconnected from invalid user fd 172.175.19.145 port 56852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.97.80
country_id: 1269750
description:
2025-11-10 09:49:22 dovecot_login authenticator failed for (183.82.97.80.actcorp.in) [183.82.97.80]:36840: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2025-11-10 09:49:36 dovecot_login authenticator failed for ([49.124.150.247]) [49.124.150.247]:53900: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Nov 10 09:54:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.49, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JVJP6DVDpMKTuYQx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 10 09:55:19 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.60, lip=66.85.158.92, session=<ggY+6zVDgOSnXpI8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 09:58:17 host2 sshd[3821679]: Disconnected from invalid user user 2.57.121.25 port 51326 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.31
country_id: 6252001
description:
Nov 10 10:02:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=48.214.144.31, lip=66.85.158.91, session=<4cUpBjZDqtgw1pAf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.54
country_id: 2963597
description:
Nov 10 10:11:36 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=89.106.141.54, lip=66.85.158.91, TLS, session=<T4GEJDZD/t5Zao02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.172
country_id: 3175395
description:
Nov 10 10:11:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.178.172, lip=66.85.158.91, TLS, session=<2q6UJTZDut25RLKs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.53
country_id: 1733045
description:
2025-11-10 10:14:41 dovecot_login authenticator failed for ([49.124.149.53]) [49.124.149.53]:47484: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-10 10:15:26 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:52552: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 10:19:11 host2 sshd[3850605]: Disconnected from invalid user kalyn 62.60.131.157 port 21726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 10 10:21:27 host2 sshd[3853453]: Disconnected from invalid user kalyn 62.60.131.157 port 9695 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-10 10:26:39 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:45504: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.207
country_id: 1733045
description:
2025-11-10 10:26:21 dovecot_login authenticator failed for ([49.124.152.207]) [49.124.152.207]:55232: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 10:28:53 host2 sshd[3862380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov 10 10:30:29 host2 pure-ftpd[3865500]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:38:10 host2 sshd[3873462]: Disconnected from invalid user david 103.61.125.242 port 46854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-11-10 10:38:43 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:56066: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2025-11-10 10:39:21 dovecot_login authenticator failed for ([49.124.149.214]) [49.124.149.214]:32930: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:40:34 host2 sshd[3875984]: Disconnected from invalid user mostafa 103.61.125.242 port 57656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:40:52 host2 sshd[3876228]: Disconnected from invalid user oracle 129.154.42.120 port 50372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 10 10:41:05 host2 sshd[3876623]: Invalid user visionsolutionshospital from 154.219.110.64 port 45548


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.61.125.242
country_id: 1733045
description:
Nov 10 10:42:02 host2 sshd[3877662]: Disconnected from invalid user erpnext 103.61.125.242 port 58296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:43:41 host2 sshd[3879477]: Disconnected from invalid user radio 129.154.42.120 port 43066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Nov 10 10:46:35 host2 sshd[3884881]: Disconnected from invalid user david 36.89.28.139 port 58942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:47:43 host2 sshd[3886121]: Disconnected from invalid user david 129.154.42.120 port 10002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 10 10:50:27 host2 sshd[3889142]: Disconnected from invalid user myuser 129.154.42.120 port 35486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Nov 10 10:50:53 host2 sshd[3889586]: Disconnected from invalid user ict 36.89.28.139 port 59058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 10 10:54:26 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, session=<YHGnvjZDxIQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-10 10:59:03 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36587: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-10 10:59:22 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:15445: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-10 11:02:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60375: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-10 11:05:57 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:52197: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-10 11:06:46 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:50950: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 11:08:02 host2 dovecot[1509044]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<hMxH7zZDQpFHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov 10 11:08:03 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<ieFa7zZDVJRHBpK5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-10 11:07:19 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:58116: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Nov 10 11:18:26 host2 sshd[3927520]: Disconnected from invalid user admin 202.51.214.99 port 50266 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-10 11:20:59 H=([87.120.36.32]) [87.120.36.32]:52212 F=<info@wikipedia.org> rejected RCPT <mikek@gibsontruckworld.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:22:39 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<G4eSIzdDvNOTuYXb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:23:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<1CcbJzdDlumTuYXb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.27.21
country_id: 3017382
description:
[2025-11-10 11:25:53 +0530] info [cpaneld] 173.249.27.21 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.120
country_id: 3175395
description:
Nov 10 11:27:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.120, lip=66.85.158.91, TLS, session=<t4DWMjdDcZq5D6t4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.99
country_id: 1643084
description:
Nov 10 11:26:34 host2 sshd[3937122]: Disconnected from invalid user steam 202.51.214.99 port 42232 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.58
country_id: 1269750
description:
Nov 10 11:26:54 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.30.83.58, lip=66.85.158.91, TLS, session=<xlSYMTdDApNnHlM6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-11-10 11:27:49 dovecot_login authenticator failed for ([50.79.249.83]) [50.79.249.83]:58823: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.219
country_id: 6252001
description:
Nov 10 11:30:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.219, lip=66.85.158.92, TLS, session=<k6dlQDdD5PGTuYXb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.7
country_id: 1733045
description:
2025-11-10 11:31:01 dovecot_login authenticator failed for ([49.124.153.7]) [49.124.153.7]:40078: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-10 11:31:18 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:34764: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.198.156
country_id: 1227603
description:
[2025-11-10 11:37:31 +0530] info [cpaneld] 112.134.198.156 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 10 11:37:45 host2 sshd[3949937]: Disconnected from invalid user user 2.57.121.25 port 30239 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 10 11:39:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<RIC9XjdD3roDU5En>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.198.156
country_id: 1227603
description:
[2025-11-10 11:39:27 +0530] info [cpaneld] 112.134.198.156 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Nov 10 11:56:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.91, session=<cEJ1nDdDtIRHBobq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.250.142.129
country_id: 1733045
description:
Nov 10 11:58:56 host2 pure-ftpd[3974337]: (?@47.250.142.129) [INFO] New connection from 47.250.142.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov 10 12:01:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.43.33.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NWFkrTdDZdstKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.210
country_id: 1819730
description:
Nov 10 12:01:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.43.33.210, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NAb8rjdD0dEtKyHS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.47
country_id: 6252001
description:
Nov 10 12:01:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.47, lip=66.85.158.92, TLS, session=<U1C5rzdDJvzG6xgv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-10 12:01:57 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:53558: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.75
country_id: 2750405
description:
Nov 10 12:02:20 host2 pure-ftpd[3978361]: (?@196.251.87.75) [INFO] New connection from 196.251.87.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-10 12:01:25 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:50405: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Nov 10 12:04:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=173.255.221.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jkRWujdDk7Ot/929>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 12:04:59 host2 sshd[3981384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 10 12:10:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<i+DzzDdDENuLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 10 12:10:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pifmzzdD9uXUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-10 12:13:43 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:47737: 535 Incorrect authentication data (set_id=hr@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 10 12:13:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ZiCo2jdDVrU+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-10 12:14:25 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:51727: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 10 12:17:46 host2 pure-ftpd[3996601]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.216
country_id: 1733045
description:
2025-11-10 12:19:26 dovecot_login authenticator failed for ([49.124.152.216]) [49.124.152.216]:34890: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-10 12:19:34 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:49932: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.155
country_id: 953987
description:
Nov 10 12:23:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=102.129.54.155, lip=66.85.158.91, TLS, session=<wKs4/TdDeO1mgTab>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.84.1.105
country_id: 3469034
description:
Nov 10 12:24:09 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=170.84.1.105, lip=66.85.158.91, TLS, session=<arp0/jdDnb+qVAFp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.232.238
country_id: 2921044
description:
Nov 10 12:24:43 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=209.38.232.238, lip=66.85.158.91, session=<OVeRAThDHOTRJuju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:30:14 host2 sshd[4011066]: Disconnected from invalid user joao 9.223.176.221 port 52232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.137
country_id: 1880251
description:
Nov 10 12:31:17 host2 sshd[4012278]: Disconnected from invalid user es_user 101.47.140.137 port 56024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:33:21 host2 sshd[4014287]: Disconnected from invalid user es_user 103.67.78.187 port 41898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:34:43 host2 sshd[4015567]: Disconnected from invalid user ars 103.67.78.187 port 53120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.115.88
country_id: 6252001
description:
[2025-11-10 12:37:07 +0530] info [cpaneld] 69.181.115.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.136.45.170
country_id: 6252001
description:
[2025-11-10 12:37:16 +0530] info [cpaneld] 169.136.45.170 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.8.137
country_id: 6252001
description:
[2025-11-10 12:37:00 +0530] info [cpaneld] 104.203.8.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.45.69.66
country_id: 6252001
description:
[2025-11-10 12:37:29 +0530] info [whostmgrd] 73.45.69.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.182.56.106
country_id: 6252001
description:
[2025-11-10 12:37:34 +0530] info [cpaneld] 174.182.56.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.31.201.171
country_id: 6252001
description:
[2025-11-10 12:37:41 +0530] info [cpaneld] 65.31.201.171 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.8.238.148
country_id: 6252001
description:
[2025-11-10 12:37:50 +0530] info [cpaneld] 204.8.238.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-10 12:37:58 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:45506: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-10 12:37:48 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:6314: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:38:48 host2 sshd[4020666]: Disconnected from invalid user ken 103.67.78.187 port 38336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:39:45 host2 sshd[4021187]: Disconnected from invalid user localhost 9.223.176.221 port 47602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.184.2
country_id: 149590
description:
Nov 10 12:42:43 host2 sshd[4022705]: Disconnected from invalid user t 102.208.184.2 port 51732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:46:57 host2 sshd[4025810]: Disconnected from invalid user support 9.223.176.221 port 55076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-10 12:47:05 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:52773: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.187
country_id: 1643084
description:
Nov 10 12:47:19 host2 sshd[4026386]: Disconnected from invalid user k8s 103.67.78.187 port 58838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-10 12:46:40 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:38662: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:49:47 host2 sshd[4027904]: Disconnected from invalid user alpha 9.223.176.221 port 59450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 10 12:52:44 host2 sshd[4029693]: Disconnected from invalid user smkim 9.223.176.221 port 54982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.107
country_id: 6252001
description:
Nov 10 12:57:37 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.107, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<I2I1dzhDEd/N0h9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 10 12:58:32 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=</Mh3ejhDkOAsyhQX>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.224.45.8
country_id: 6252001
description:
[2025-11-10 13:03:55 +0530] info [cpaneld] 24.224.45.8 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.218.200.95
country_id: 6252001
description:
[2025-11-10 13:03:57 +0530] info [cpaneld] 107.218.200.95 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.132.199.190
country_id: 6252001
description:
[2025-11-10 13:03:58 +0530] info [cpaneld] 74.132.199.190 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.102.158
country_id: 6252001
description:
[2025-11-10 13:04:06 +0530] info [whostmgrd] 104.5.102.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.72.191
country_id: 6252001
description:
[2025-11-10 13:04:17 +0530] info [cpaneld] 74.244.72.191 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.215.39.94
country_id: 6252001
description:
[2025-11-10 13:04:37 +0530] info [cpaneld] 74.215.39.94 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.250.19
country_id: 6252001
description:
Nov 10 13:05:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.40.250.19, lip=66.85.158.91, session=<grqdkzhDlpMUKPoT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov 10 13:08:19 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J1F5nThDzq2s7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-10 13:08:24 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:41450: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.106.246.117
country_id: 6252001
description:
[2025-11-10 13:10:18 +0530] info [cpaneld] 131.106.246.117 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.12.68
country_id: 6252001
description:
[2025-11-10 13:10:22 +0530] info [whostmgrd] 172.113.12.68 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.188.194
country_id: 6252001
description:
[2025-11-10 13:10:10 +0530] info [cpaneld] 172.59.188.194 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.94.52
country_id: 6252001
description:
[2025-11-10 13:10:14 +0530] info [cpaneld] 172.56.94.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.227.234
country_id: 6252001
description:
[2025-11-10 13:10:39 +0530] info [cpaneld] 172.251.227.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.247.189.84
country_id: 6252001
description:
[2025-11-10 13:10:46 +0530] info [cpaneld] 158.247.189.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.233.65
country_id: 6252001
description:
Nov 10 13:10:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.233.65, lip=66.85.158.91, session=<DjtkpjhDBtKs7OlB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.126.184
country_id: 6252001
description:
[2025-11-10 13:10:25 +0530] info [cpaneld] 174.168.126.184 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Nov 10 13:12:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.92, TLS, session=<PvfeqjhDRIktT7Vo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-11-10 13:17:42 dovecot_login authenticator failed for ([127.0.0.1]) [122.186.202.10]:59762: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.217.177
country_id: 289688
description:
2025-11-10 13:18:02 dovecot_login authenticator failed for ([127.0.0.1]) [78.101.217.177]:45648: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.87.61
country_id: 2750405
description:
Nov 10 13:19:27 host2 pure-ftpd[4044777]: (?@196.251.87.61) [INFO] New connection from 196.251.87.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-10 13:20:39 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:55511: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-10 13:20:49 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:51660: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 54.226.188.193
country_id: 6252001
description:
Nov 10 13:28:20 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=54.226.188.193, lip=66.85.158.91, TLS: Connection closed, session=<sJu/5DhDYqo24rzB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 54.226.188.193
country_id: 6252001
description:
Nov 10 13:29:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 79 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=54.226.188.193, lip=66.85.158.91, TLS: Connection closed, session=<43od5ThDXNA24rzB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-10 13:31:32 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:58251: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-10 13:31:44 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:58968: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.48.68.165
country_id: 1210997
description:
[2025-11-10 13:34:20 +0530] info [cpaneld] 182.48.68.165 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.46
country_id: 6252001
description:
Nov 10 13:35:11 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.46, lip=66.85.158.91, TLS, session=<OoyQ/ThDsuXN0h8u>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:35:27 host2 sshd[4053171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov 10 13:35:58 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3ZpWADlDhMpBMQHK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:36:36 host2 sshd[4053663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov 10 13:36:33 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS: Connection closed, session=<AqZ5AjlDSDZBMQHK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:37:27 host2 sshd[4054004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:40:04 host2 sshd[4055139]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:40:49 host2 sshd[4055599]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:41:24 host2 sshd[4055835]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 10 13:42:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<bbsCFzlDIIanXpI/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:42:38 host2 sshd[4056475]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:43:25 host2 sshd[4056884]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 10 13:44:26 host2 sshd[4057484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.48.89
country_id: 6251999
description:
2025-11-10 13:47:19 dovecot_login authenticator failed for (89.48.158.104.in-addr.arpa) [104.158.48.89]:37985: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-10 13:47:43 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:60573: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.87.15.221
country_id: 3996063
description:
Nov 10 13:48:20 host2 sshd[4060018]: Disconnected from invalid user super 47.87.15.221 port 46010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.57
country_id: 798544
description:
Nov 10 13:48:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.246.210.57, lip=66.85.158.91, TLS, session=<iSTBKzlDONBb9tI5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.103
country_id: 3469034
description:
Nov 10 13:48:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.209.246.103, lip=66.85.158.91, TLS, session=<ZZn1LDlDBNS60fZn>


