# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.226.62.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.226.62.234 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.151.223.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.151.223.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.81.100
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.41.81.100 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.23.236.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.23.236.154 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.64.40.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.64.40.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 16:01:05 host2 sshd[3506956]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.237.21
country_id: 1880251
description:
Nov 18 16:01:56 host2 sshd[3507286]: Disconnected from invalid user remote 45.78.237.21 port 37936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.135
country_id: 6252001
description:
Nov 18 16:05:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<o7m8BdxD3N3N0h+H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 18 16:05:39 host2 sshd[3510023]: Disconnected from invalid user runner 152.32.201.226 port 22250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:09:52 host2 sshd[3512383]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 59884


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 18 16:15:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<Q7dnKdxDeOyLonHU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.206.212.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.206.212.77 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.131.99.38
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.131.99.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.92.84
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.92.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.6.146.68
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.6.146.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.34.138.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.34.138.147 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.155.230.197
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.155.230.197 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.63.132.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.63.132.226 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:22:30 host2 sshd[3520778]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 59414


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.42.201
country_id: 6252001
description:
Nov 18 16:24:44 host2 sshd[3522009]: Disconnected from invalid user shalini 172.245.42.201 port 55396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-18 16:28:18 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:55338: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-18 16:28:35 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:36708: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-18 16:29:39 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:37482: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-18 16:29:46 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:57763: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.175.61.93
country_id: 3469034
description:
2025-11-18 16:29:52 dovecot_login authenticator failed for (179-175-61-93.user.vivozap.com.br) [179.175.61.93]:47676: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.42.201
country_id: 6252001
description:
Nov 18 16:31:01 host2 sshd[3525951]: Disconnected from invalid user admin 172.245.42.201 port 41208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 16:30:58 host2 sshd[3525927]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 61565


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:31:10 host2 sshd[3526066]: Disconnected from invalid user tony 103.159.199.42 port 39238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:32:27 host2 sshd[3526827]: Disconnected from invalid user sanjay 151.49.129.67 port 52182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-18 16:33:24 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:59463: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.22
country_id: 1733045
description:
2025-11-18 16:33:44 dovecot_login authenticator failed for ([49.124.153.22]) [49.124.153.22]:58488: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 45.33.70.128
country_id: 6252001
description:
Nov 18 16:34:55 host2 pure-ftpd[3528093]: (?@45.33.70.128) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:36:00 host2 sshd[3528883]: Disconnected from invalid user newuser 103.159.199.42 port 53818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:37:21 host2 sshd[3529730]: Disconnected from invalid user admin 151.49.129.67 port 34558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:37:20 host2 sshd[3529720]: Disconnected from invalid user bill 103.159.199.42 port 48064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:40:50 host2 sshd[3531994]: Disconnected from invalid user newuser 151.49.129.67 port 51980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:41:24 host2 sshd[3532331]: Disconnected from invalid user dmdba 103.159.199.42 port 58936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:42:00 host2 sshd[3532710]: Disconnected from invalid user pendulum 151.49.129.67 port 58372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 18 16:42:42 host2 sshd[3533145]: Disconnected from invalid user mh 103.159.199.42 port 49154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov 18 16:43:07 host2 sshd[3533412]: Disconnected from invalid user debian 151.49.129.67 port 58036 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 18 16:50:33 host2 pure-ftpd[3538666]: (?@165.227.134.101) [INFO] New connection from 165.227.134.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.222.165
country_id: 2921044
description:
Nov 18 16:50:32 host2 pure-ftpd[3538664]: (?@68.183.222.165) [INFO] New connection from 68.183.222.165


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 18 16:51:29 host2 pure-ftpd[3539286]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.144.110
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.144.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.27.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 69.181.27.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.140.169
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.50.140.169 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.182.106.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.182.106.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.2.164.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.2.164.39 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.145.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.145.60 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.10.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.51.10.36 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 18 16:54:26 host2 pure-ftpd[3541605]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 18 16:54:23 host2 pure-ftpd[3541537]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-18 17:00:19 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:48804: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-18 17:00:40 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:33332: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.160.19
country_id: 3017382
description:
[2025-11-18 17:03:06 +0530] info [cpaneld] 163.5.160.19 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 17:03:05 host2 sshd[3547673]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 60096


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.5.160.19
country_id: 3017382
description:
[2025-11-18 17:10:53 +0530] info [cpaneld] 163.5.160.19 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 18 17:10:53 host2 sshd[3552762]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 60908


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.82.220
country_id: 6252001
description:
Nov 18 17:11:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.80.82.220, lip=66.85.158.92, session=<sVcY8dxDVLQUUFLc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-18 17:13:43 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:47844: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-18 17:14:40 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:45440: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.160.125
country_id: 6252001
description:
[2025-11-18 17:15:20 +0530] info [cpaneld] 172.59.160.125 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.226.64.170
country_id: 6252001
description:
[2025-11-18 17:15:22 +0530] info [whostmgrd] 162.226.64.170 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.223.70.221
country_id: 6252001
description:
[2025-11-18 17:15:25 +0530] info [cpaneld] 97.223.70.221 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.61.7
country_id: 6252001
description:
[2025-11-18 17:15:10 +0530] info [cpaneld] 76.37.61.7 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.186.220.252
country_id: 6252001
description:
[2025-11-18 17:15:16 +0530] info [cpaneld] 98.186.220.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.167.138
country_id: 6252001
description:
[2025-11-18 17:15:41 +0530] info [cpaneld] 140.228.167.138 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.77.228.98
country_id: 6252001
description:
[2025-11-18 17:15:49 +0530] info [cpaneld] 173.77.228.98 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:17:40 host2 sshd[3557236]: Disconnected from invalid user jose 177.130.248.114 port 58296 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.7
country_id: 6252001
description:
Nov 18 17:17:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.173.7, lip=66.85.158.91, session=<YpSBBt1DwK0ofK0H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.223.70.148
country_id: 6252001
description:
[2025-11-18 17:18:47 +0530] info [cpaneld] 172.223.70.148 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.235.152
country_id: 6252001
description:
[2025-11-18 17:18:53 +0530] info [cpaneld] 172.56.235.152 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.255.252.47
country_id: 6252001
description:
[2025-11-18 17:18:43 +0530] info [whostmgrd] 71.255.252.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.222.111.65
country_id: 6252001
description:
[2025-11-18 17:18:42 +0530] info [cpaneld] 47.222.111.65 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.178.112.68
country_id: 6252001
description:
[2025-11-18 17:18:50 +0530] info [cpaneld] 104.178.112.68 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.226.94.195
country_id: 6252001
description:
[2025-11-18 17:18:34 +0530] info [cpaneld] 108.226.94.195 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.45.49.215
country_id: 6252001
description:
[2025-11-18 17:18:36 +0530] info [cpaneld] 75.45.49.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:19:57 host2 sshd[3558522]: Disconnected from invalid user partner 152.32.189.21 port 53754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:19:16 host2 sshd[3558219]: Disconnected from invalid user jramirez 177.130.248.114 port 33812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:22:39 host2 sshd[3560307]: Disconnected from invalid user jramirez 152.32.189.21 port 38956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 18 17:22:07 host2 sshd[3560003]: Disconnected from invalid user ftpuser 177.130.248.114 port 41160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Nov 18 17:23:56 host2 sshd[3561227]: Disconnected from invalid user jose 152.32.189.21 port 47114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-11-18 17:25:22 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:57074: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 17:26:23 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:34410: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.99.208
country_id: 6252001
description:
Nov 18 17:27:07 host2 sshd[3563438]: Disconnected from invalid user podcast 192.3.99.208 port 38460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-18 17:31:39 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:51876: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 18 17:38:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS: Connection closed, session=<vhalUt1DCOGUccE7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 18 17:39:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<umY9V91DvoqUccE7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-11-18 17:41:30 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:47088: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-18 17:42:45 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:50900: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-11-18 17:42:57 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:58570: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-18 17:42:20 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:50454: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 17:44:42 host2 sshd[3575750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 17:56:34 host2 sshd[3586886]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.190.163.191
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.190.163.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.111.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.33.111.79 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.34.205
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.19.34.205 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.123.178.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 163.123.178.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.95.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.8.95.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 17:57:07 host2 sshd[3587248]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 51897


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.130.74.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.130.74.182 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.56.209.231
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.56.209.231 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.40
country_id: 6252001
description:
Nov 18 18:01:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.40, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hCKgpd1DauqsynYo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Nov 18 18:05:08 host2 sshd[3594155]: Disconnected from invalid user ubuntu 181.104.58.194 port 46726 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.22
country_id: 6252001
description:
Nov 18 18:08:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.82.22, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3Ft2vt1DjJI0pVIW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.104.58.194
country_id: 3865483
description:
Nov 18 18:09:05 host2 sshd[3596980]: Disconnected from invalid user salon 181.104.58.194 port 52226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-18 18:09:58 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:34454: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-18 18:09:11 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:49488: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 18:10:25 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:56172: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-11-18 18:10:43 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:44403: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-18 18:11:32 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:38580: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-18 18:11:43 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:50838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 18 18:13:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AZoiz91D1K9ChJmA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-11-18 18:13:47 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:32882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-18 18:14:10 dovecot_login authenticator failed for ([186.235.248.73]) [186.235.248.73]:33080: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 18:26:42 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:45892: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-11-18 18:26:30 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:51610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.149
country_id: 6252001
description:
Nov 18 18:31:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.149, lip=66.85.158.92, TLS: Connection closed, session=<URywEN5DarzHLZqV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-18 18:33:28 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:51068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-18 18:33:12 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:37246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.35
country_id: 1880251
description:
Nov 18 18:35:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=139.99.35.35, lip=66.85.158.91, session=<a0GsHt5DW4+LYyMj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 18 18:35:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, session=<kvxnH95DA5OLYyMq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 18:35:50 host2 sshd[3614207]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.208.120
country_id: 2921044
description:
Nov 18 18:35:08 host2 pure-ftpd[3613912]: (?@46.101.208.120) [INFO] New connection from 46.101.208.120


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 18 18:35:09 host2 pure-ftpd[3613919]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-18 18:40:58 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:39555: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-18 18:41:12 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50982: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.14.222
country_id: 6252001
description:
Nov 18 18:49:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.14.222, lip=66.85.158.92, session=<MDSmUd5D1LYUow7e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 18:50:38 host2 sshd[3623237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.116.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.116.55 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.222.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.59.222.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.248.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.248.194 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.114.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.114.77 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.32.144.201
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.32.144.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.209.41
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.209.41 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.135.110.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.135.110.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 18:54:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62999: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.156
country_id: 6252001
description:
Nov 18 18:56:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.162.156, lip=66.85.158.91, session=<o/91aN5DsuGCg6Kc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 18:57:12 host2 sshd[3628055]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-11-18 19:00:34 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:35062: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-18 19:00:51 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:32568: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 19:00:27 host2 sshd[3629932]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 19:03:38 host2 sshd[3632144]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60855


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 18 19:06:29 host2 pure-ftpd[3634088]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=107.150.117.121, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cLVal95D5LlrlnV5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:09:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=107.150.117.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<07/3l95D8LlrlnV5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.17
country_id: 2635167
description:
Nov 18 19:09:36 host2 pure-ftpd[3635997]: (?@87.236.176.17) [INFO] New connection from 87.236.176.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.41.172
country_id: 390903
description:
2025-11-18 19:10:48 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:47548: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-18 19:10:59 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:58846: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-18 19:14:05 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:40700: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov 18 19:17:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, session=<wUd/tN5DiG9APpyi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.114
country_id: 6252001
description:
Nov 18 19:17:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.114, lip=66.85.158.91, session=<PlSutd5DeY5APsVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Nov 18 19:18:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS: Connection closed, session=<H2xztt5DKHJAPsVr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:22:11 host2 sshd[3644015]: Disconnected from invalid user fabio 107.172.235.53 port 43014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:23:28 host2 sshd[3644968]: Disconnected from invalid user admin 107.172.235.53 port 40372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:23:28 host2 sshd[3644946]: Disconnected from invalid user sonar 45.78.205.209 port 52452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:23:34 host2 sshd[3645145]: Disconnected from invalid user deploy 103.187.147.214 port 45166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 18 19:24:35 host2 sshd[3645791]: Disconnected from invalid user user 107.172.235.53 port 14544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-11-18 19:25:59 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:59747: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-18 19:26:19 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:50104: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:26:46 host2 sshd[3647280]: Disconnected from invalid user admin 103.187.147.214 port 58226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.214
country_id: 1643084
description:
Nov 18 19:28:14 host2 sshd[3648596]: Disconnected from invalid user ubuntu 103.187.147.214 port 36816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:28:48 host2 sshd[3648935]: Disconnected from invalid user mike 45.78.205.209 port 52112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:34:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UoPp8N5Dtc0jy9JE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:35:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<i2+c9N5D3vojy9JE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 19:35:36 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:38914: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.201.11
country_id: 1168579
description:
2025-11-18 19:35:55 dovecot_login authenticator failed for (static.khi77.pie.net.pk) [221.120.201.11]:48933: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 107.150.117.121
country_id: 2921044
description:
Nov 18 19:37:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=107.150.117.121, lip=66.85.158.91, TLS, session=<FEjj+95DpNdrlnV5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 19:40:26 host2 sshd[3655715]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.209
country_id: 1880251
description:
Nov 18 19:42:04 host2 sshd[3656696]: Disconnected from invalid user temp_user 45.78.205.209 port 36496 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.68
country_id: 2635167
description:
Nov 18 19:41:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.68, lip=66.85.158.91, TLS, session=<uQCnC99Dyvwjy9JE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:45:07 host2 sshd[3659098]: Disconnected from invalid user igor 154.205.129.28 port 55420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:46:14 host2 sshd[3659717]: Disconnected from invalid user zmarin 154.205.129.28 port 54170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.205.129.28
country_id: 3017382
description:
Nov 18 19:50:29 host2 sshd[3662133]: Disconnected from invalid user user8 154.205.129.28 port 47746 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 19:52:17 host2 sshd[3663157]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-18 19:53:14 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:51492: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 18 19:56:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS, session=<8TmTQN9D+uWUcdZj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.240.125.200
country_id: 2635167
description:
2025-11-18 19:57:02 dovecot_login authenticator failed for host-89-240-125-200.as13285.net [89.240.125.200]:41136: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 19:56:18 host2 sshd[3666719]: Disconnected from invalid user ac 150.5.129.10 port 45036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-18 19:58:03 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:36851: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 19:59:40 host2 sshd[3668506]: Disconnected from invalid user tino 150.5.129.10 port 52286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 20:01:24 host2 sshd[3669701]: Disconnected from invalid user vpn 150.5.129.10 port 55930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 18 20:03:06 host2 sshd[3670950]: Disconnected from invalid user sammy 150.5.129.10 port 59540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-18 20:02:19 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:52500: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-11-18 20:02:34 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:58188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 20:05:11 host2 sshd[3672220]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 55090


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 20:05:54 host2 sshd[3672652]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58008


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 20:08:57 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:35686: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.186.182.85
country_id: 6252001
description:
Nov 18 20:08:57 host2 pure-ftpd[3674340]: (?@52.186.182.85) [INFO] New connection from 52.186.182.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-18 20:09:57 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:47420: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 20:17:48 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:20451: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-18 20:18:06 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:54478: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 18 20:19:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sW6CkN9DAIJChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-18 20:24:16 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:36355: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.206
country_id: 6252001
description:
Nov 18 20:26:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.206, lip=66.85.158.92, session=<n9bmqd9DdZHDuEzO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.152
country_id: 3996063
description:
Nov 18 20:27:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=138.122.97.152, lip=66.85.158.91, TLS, session=<EG63rN9Dx+SKemGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.207
country_id: 6252001
description:
Nov 18 20:26:24 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.207, lip=66.85.158.92, session=<5Snuqt9DscbDuEzP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.167
country_id: 6252001
description:
Nov 18 20:26:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.167, lip=66.85.158.92, session=<vjoeq99Dp83DuEyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.137.87
country_id: 2963597
description:
Nov 18 20:26:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=89.106.137.87, lip=66.85.158.91, TLS, session=<hCOsq99DGN1ZaolX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.140.93.55
country_id: 6252001
description:
Nov 18 20:30:33 host2 sshd[3688636]: Disconnected from invalid user pwserver 166.140.93.55 port 35390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.140.93.55
country_id: 6252001
description:
Nov 18 20:33:29 host2 sshd[3690061]: Disconnected from invalid user oracle 166.140.93.55 port 35166 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.182
country_id: 6252001
description:
Nov 18 20:37:42 host2 pure-ftpd[3692768]: (?@205.210.31.182) [INFO] New connection from 205.210.31.182


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.187.48.82
country_id: 130758
description:
Nov 18 20:45:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.187.48.82, lip=66.85.158.91, TLS, session=<qwV67d9DPee5uzBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.84
country_id: 6252001
description:
Nov 18 20:45:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.84, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vTnJ7t9Dy+FBMQFU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.161
country_id: 3175395
description:
Nov 18 20:45:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.161, lip=66.85.158.91, TLS, session=<mW2e7t9DLZ6rFuuh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 18 20:45:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0VH9799DoKFBMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-18 20:48:40 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:49382: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-18 20:48:56 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:40484: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-18 20:50:29 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:30414: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-18 20:51:16 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:39808: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.245
country_id: 6252001
description:
Nov 18 20:51:57 host2 pure-ftpd[3701975]: (?@198.235.24.245) [INFO] New connection from 198.235.24.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-18 20:52:06 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38975: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-18 20:51:51 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:42136: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 20:53:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CUFpCuBDcOmlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 20:53:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=165.154.164.24, lip=66.85.158.91, TLS, session=<iDsmDOBDiK6lmqQY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2025-11-18 20:59:11 dovecot_login authenticator failed for ([217.26.194.79]) [217.26.194.79]:59870: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-18 20:59:44 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:46716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 21:01:08 host2 sshd[3708120]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59834


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-18 21:03:57 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:40533: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-18 21:04:28 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:53200: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-18 21:10:26 dovecot_plain authenticator failed for (dione) [65.20.174.63]:36072: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-18 21:29:45 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:60934: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-18 21:30:15 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:37176: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 18 21:34:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS: Connection closed, session=<d0sIneBD2LyUcdZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.177.134
country_id: 3175395
description:
Nov 18 21:34:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.68.177.134, lip=66.85.158.91, TLS, session=<dzFyneBDmZ+5RLGG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.230
country_id: 2300660
description:
Nov 18 21:35:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.47.230, lip=66.85.158.91, TLS, session=<C9o7n+BD+80piy/m>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 21:36:46 host2 sshd[3732837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.22
country_id: 3017382
description:
Nov 18 21:37:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.22, lip=66.85.158.92, session=<DrsEqeBDxaVbxJgW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.109
country_id: 3017382
description:
Nov 18 21:37:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.109, lip=66.85.158.92, session=<Io6nqeBDR+pbxJht>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.19
country_id: 3017382
description:
Nov 18 21:37:50 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.19, lip=66.85.158.92, session=<rA1iquBDy7JbxJgT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.111
country_id: 3017382
description:
Nov 18 21:37:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.111, lip=66.85.158.92, session=<IlSUquBDV4lbxJhv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 21:42:05 host2 sshd[3748912]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 52006


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov 18 21:42:05 host2 pure-ftpd[3748971]: (?@64.62.156.202) [INFO] New connection from 64.62.156.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-18 21:46:51 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:41088: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 21:47:23 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:57598: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 18 21:48:38 host2 sshd[3753219]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 21:48:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</c+p0OBDVuGlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 18 21:48:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<m5A90uBDcny4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.50.24
country_id: 6252001
description:
Nov 18 21:49:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.50.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wwhg0uBDAJctITIY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.164.24
country_id: 2921044
description:
Nov 18 21:49:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.164.24, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<diGA0+BDNJWlmqQY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 18 21:49:28 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<zHf40+BDrEi4aYtD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:01:06 host2 sshd[3761579]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 51334


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:03:18 host2 sshd[3763499]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63502


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-11-18 22:03:40 dovecot_login authenticator failed for ([201.173.250.31]) [201.173.250.31]:34981: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-18 22:09:15 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:38710: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-18 22:09:23 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:56390: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-18 22:09:25 dovecot_login authenticator failed for (ofluminense.static.gvt.net.br) [189.97.236.201]:60528: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-18 22:09:41 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:34070: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.223
country_id: 3469034
description:
Nov 18 22:10:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.89.136.223, lip=66.85.158.91, TLS, session=<DGh/H+FDNb6+WYjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.33
country_id: 1269750
description:
Nov 18 22:11:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.237.56.33, lip=66.85.158.91, TLS, session=<Tk+9IOFD0pJn7Tgh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:17:37 host2 sshd[3773863]: Disconnected from invalid user backend 42.191.158.240 port 57082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:17:44 host2 sshd[3773895]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 49644


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:19:34 host2 sshd[3775204]: Disconnected from invalid user admin 123.58.213.52 port 52530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:21:29 host2 sshd[3776861]: Disconnected from invalid user ftpuser 123.58.213.52 port 40540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:24:58 host2 sshd[3779363]: Disconnected from invalid user siva 152.32.135.139 port 36200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:25:25 host2 sshd[3779837]: Disconnected from invalid user alexey 123.58.213.52 port 57042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:26:17 host2 sshd[3780477]: Disconnected from invalid user abhi 152.32.135.139 port 36334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:27:47 host2 sshd[3781553]: Disconnected from invalid user pavan 42.191.158.240 port 47673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2025-11-18 22:29:05 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5996: 535 Incorrect authentication data


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.191.158.240
country_id: 1733045
description:
Nov 18 22:29:18 host2 sshd[3782478]: Disconnected from invalid user jean 42.191.158.240 port 35140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-18 22:29:25 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:47336: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-18 22:29:52 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:47098: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:30:05 host2 sshd[3783149]: Disconnected from invalid user james 152.32.135.139 port 59992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:29:13 host2 sshd[3782443]: Disconnected from invalid user ubuntu 123.58.213.52 port 44658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 18 22:30:31 host2 sshd[3783469]: Disconnected from invalid user siva 123.58.213.52 port 57174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.139
country_id: 1819730
description:
Nov 18 22:32:37 host2 sshd[3784965]: Disconnected from invalid user victor 152.32.135.139 port 54016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-18 22:34:38 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:63158: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-18 22:35:18 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:62325: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 18 22:37:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<lnrAf+FDCrGLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 18 22:40:01 host2 sshd[3790438]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63070


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 18 22:41:06 host2 pure-ftpd[3791636]: (?@167.94.146.59) [INFO] New connection from 167.94.146.59


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.72
country_id: 6252001
description:
Nov 18 22:42:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.72, lip=66.85.158.92, session=<hMP5keFDLUdAPpxI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Nov 18 22:42:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.92, TLS: Connection closed, session=<YXOqkuFDJr9APpxC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a02:c207:2280:7050::1
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a02:c207:2280:7050::1 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.127.242.250
country_id: 3017382
description:
2025-11-18 22:49:03 dovecot_login authenticator failed for laubervilliers-656-1-68-250.w82-127.abo.wanadoo.fr [82.127.242.250]:33606: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-11-18 22:49:24 dovecot_login authenticator failed for ([130.185.102.59]) [130.185.102.59]:50458: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 22:50:32 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:57748: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-18 22:52:51 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:50170: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-18 22:53:19 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:39438: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-18 23:00:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58968: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 23:06:39 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55917: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-18 23:07:21 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:47626: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.42
country_id: 3175395
description:
Nov 18 23:07:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.171.42, lip=66.85.158.91, TLS, session=<O2eI6eFDT5G5D6sq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.226
country_id: 3469034
description:
Nov 18 23:07:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=190.89.137.226, lip=66.85.158.91, TLS, session=<o3em6uFDkIa+WYni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 18 23:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CBKU7+FDv3tBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 18 23:09:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.152, lip=66.85.158.91, TLS: Connection closed, session=<Rm2K8eFDHHtBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.67.90
country_id: 2921044
description:
Nov 18 23:10:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.67.90, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<WCpE9OFDfTOlFkNa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.67.90
country_id: 2921044
description:
Nov 18 23:10:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=165.22.67.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<5oio9OFDdzWlFkNa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 18 23:10:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=161.35.220.193, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ivpf9uFDcumhI9zB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-18 23:13:39 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:59504: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.134
country_id: 690791
description:
Nov 18 23:15:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=194.44.140.134, lip=66.85.158.91, TLS, session=<UcQBB+JD59rCLIyG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.8
country_id: 2300660
description:
Nov 18 23:15:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=41.139.44.8, lip=66.85.158.91, TLS, session=<MKE8COJDIIgpiywI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:29:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RzbzOeJDicei2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:30:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<15QMPeJDoPCi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:31:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<YeU7QOJDuvCi2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Nov 18 23:33:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<ewsbRuJDRtXE+2Qw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.170
country_id: 953987
description:
Nov 18 23:37:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.46.170, lip=66.85.158.91, TLS, session=<B89nU+JDPopmQC6q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.139.82.44
country_id: 798544
description:
Nov 18 23:37:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=79.139.82.44, lip=66.85.158.91, TLS, session=<O9mwVOJDya1Pi1Is>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:37:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS, session=<2uvRVuJDLvmi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 18 23:38:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.92, TLS, session=<3mPkWuJDrvui2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.107.56
country_id: 3469034
description:
Nov 18 23:43:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.120.107.56, lip=66.85.158.91, TLS, session=<MOGYauJDGJe7eGs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.122
country_id: 226074
description:
Nov 18 23:43:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=196.0.10.122, lip=66.85.158.91, TLS, session=<kyXha+JDsrzEAAp6>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 2.177.30.175
country_id: 130758
description:
Nov 18 23:46:23 host2 sshd[3832476]: Disconnecting authenticating user root 2.177.30.175 port 52783: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 2.177.30.175
country_id: 130758
description:
Nov 18 23:46:23 host2 sshd[3832476]: error: maximum authentication attempts exceeded for root from 2.177.30.175 port 52783 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 18 23:57:25 host2 sshd[3839613]: Disconnected from invalid user devuser 103.182.132.154 port 49848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:02:10 host2 sshd[3842945]: Disconnected from invalid user oracle 103.182.132.154 port 43942 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 19 00:02:53 host2 pure-ftpd[3843288]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.35.220.193
country_id: 2921044
description:
Nov 19 00:03:01 host2 pure-ftpd[3843391]: (?@161.35.220.193) [INFO] New connection from 161.35.220.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:03:40 host2 sshd[3844033]: Disconnected from invalid user pivpn 103.182.132.154 port 45974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Nov 19 00:06:43 host2 sshd[3846009]: Disconnected from invalid user dashuai 103.182.132.154 port 51162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 19 00:07:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x9KpwuJDaFFBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 19 00:08:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<bfRHxOJD4HxBMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-19 00:19:22 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:35074: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-19 00:19:38 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34735: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.25
country_id: 3865483
description:
Nov 19 00:20:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=181.191.223.25, lip=66.85.158.91, TLS, session=<5wIl7+JDIdi1v98Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.56
country_id: 798544
description:
Nov 19 00:20:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=91.231.122.56, lip=66.85.158.91, TLS, session=</LyH8OJDcMhb53o4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.32.25
country_id: 6252001
description:
2025-11-19 00:23:48 dovecot_plain authenticator failed for ([100.64.100.6]) [104.234.32.25]:62530: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.49
country_id: 2264397
description:
Nov 19 00:31:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7MCRFuNDtdC54sUx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.48
country_id: 2264397
description:
Nov 19 00:31:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.226.197.48, lip=66.85.158.92, TLS, session=<pMDHFuNDhbq54sUw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.49
country_id: 2264397
description:
Nov 19 00:31:08 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.197.49, lip=66.85.158.92, TLS, session=<T+QpFuNDHYC54sUx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.47
country_id: 2264397
description:
Nov 19 00:31:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.226.197.47, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+dlHFuNDhqC54sUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.50
country_id: 2264397
description:
Nov 19 00:31:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.226.197.50, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<9ylsFuNDc4254sUy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-19 00:34:40 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:45832: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-19 00:37:45 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:55943: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-19 00:38:24 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:49263: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 145.220.0.84
country_id: 2750405
description:
Nov 19 00:41:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share (no auth attempts in 0 secs): user=<>, rip=145.220.0.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share, session=<yQWPOuNDTIaR3ABU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-11-19 00:45:02 dovecot_login authenticator failed for 31-151-70-150.dynamic.upc.nl [31.151.70.150]:33199: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-19 00:45:28 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:47520: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-19 00:46:05 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:60154: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-19 00:46:23 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:28712: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.152
country_id: 3175395
description:
Nov 19 00:57:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.178.152, lip=66.85.158.91, TLS, session=<Uex2dONDOc/ZGrKY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.177
country_id: 3469034
description:
Nov 19 00:58:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=187.120.72.177, lip=66.85.158.91, TLS, session=<hyCideND5su7eEix>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.56
country_id: 3469034
description:
Nov 19 00:59:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=138.36.202.56, lip=66.85.158.91, TLS, session=<LSZseuNDhsSKJMo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.141
country_id: 1269750
description:
Nov 19 00:59:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.164.246.141, lip=66.85.158.91, TLS, session=<3x64e+NDvdVnpPaN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:00:39 host2 sshd[3881248]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.121.242.92
country_id: 6252001
description:
Nov 19 01:05:07 host2 pure-ftpd[3884120]: (?@34.121.242.92) [INFO] New connection from 34.121.242.92


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:12:18 host2 sshd[3888565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Nov 19 01:12:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.231, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6pf6quNDecaTuYTn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.252.27.15
country_id: 1643084
description:
2025-11-19 01:24:58 dovecot_plain authenticator failed for ([31.57.166.48]) [180.252.27.15]:47152: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.75.2
country_id: 3469034
description:
2025-11-19 01:24:31 dovecot_plain authenticator failed for ([31.57.166.48]) [168.121.75.2]:15040: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.224.94
country_id: 3625428
description:
2025-11-19 01:24:42 dovecot_plain authenticator failed for ([31.57.166.48]) [190.97.224.94]:43006: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-19 01:25:40 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:55563: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov 19 01:25:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS: Connection closed, session=<7Dqe2eND8OrLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-19 01:26:03 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:42930: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.108
country_id: 3469034
description:
Nov 19 01:26:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.189.201.108, lip=66.85.158.91, session=<bf2Y3ONDFoOzvcls>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.126
country_id: 3175395
description:
Nov 19 01:27:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.197.8.126, lip=66.85.158.91, TLS, session=<62Pd3eNDVou5xQh+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 19 01:27:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<8lcW3uNDImRChJmO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 19 01:27:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS, session=<qI1z3uNDNMZChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.27.24.117
country_id: 3489940
description:
2025-11-19 01:29:26 dovecot_plain authenticator failed for ([31.57.166.48]) [72.27.24.117]:46470: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.110.147.175
country_id: 3865483
description:
2025-11-19 01:29:38 dovecot_plain authenticator failed for ([31.57.166.48]) [181.110.147.175]:57820: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.180.186.170
country_id: 3469034
description:
2025-11-19 01:29:51 dovecot_plain authenticator failed for ([31.57.166.48]) [187.180.186.170]:22266: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:30:25 host2 sshd[3899839]: Disconnected from invalid user administrator 92.185.99.40 port 49240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.173
country_id: 6252001
description:
2025-11-19 01:30:31 dovecot_login authenticator failed for (lezzarotech.com) [89.187.173.173]:59900: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:32:41 host2 sshd[3901176]: Disconnected from invalid user vpn 92.185.99.40 port 43114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.38.201.125
country_id: 3469034
description:
2025-11-19 01:33:31 dovecot_plain authenticator failed for ([31.57.166.48]) [189.38.201.125]:37344: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.62.44.14
country_id: 6252001
description:
2025-11-19 01:33:42 dovecot_plain authenticator failed for 75-62-44-14.lightspeed.oshkwi.sbcglobal.net ([31.57.166.48]) [75.62.44.14]:36238: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.232.147.135
country_id: 3865483
description:
2025-11-19 01:33:47 dovecot_plain authenticator failed for nat-45-232-147-135.dynamic.federacionnet.com.ar ([31.57.166.48]) [45.232.147.135]:54828: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.109.198
country_id: 3077311
description:
2025-11-19 01:33:54 dovecot_plain authenticator failed for ([31.57.166.48]) [185.15.109.198]:50526: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.225.52
country_id: 1210997
description:
2025-11-19 01:34:03 dovecot_plain authenticator failed for ([31.57.166.48]) [103.174.225.52]:51894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.225.52
country_id: 1210997
description:
2025-11-19 01:34:10 dovecot_login authenticator failed for ([31.57.166.48]) [103.174.225.52]:51894: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.22.70.139
country_id: 2635167
description:
2025-11-19 01:34:15 dovecot_plain authenticator failed for seac-27-b2-v4wan-167637-cust650.vm25.cable.virginm.net ([31.57.166.48]) [86.22.70.139]:40520: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 19 01:36:05 host2 sshd[3903601]: Disconnected from invalid user srv 92.185.99.40 port 60616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-19 01:37:52 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:54574: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-19 01:38:12 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:60293: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Nov 19 01:38:52 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.92, session=<wBpkCORDZEes7OTl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-11-19 01:39:18 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:33752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-19 01:39:30 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:47928: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.232
country_id: 6252001
description:
Nov 19 01:41:35 host2 pure-ftpd[3906857]: (?@205.210.31.232) [INFO] New connection from 205.210.31.232


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.42
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.42, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lXR5GORDbqC5tI0q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.43
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.43, lip=66.85.158.92, session=<2F92GORDs825tI0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.43
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ENx+GORDocW5tI0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.45
country_id: 2264397
description:
Nov 19 01:43:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.45, lip=66.85.158.92, TLS, session=<9gV9GORDmeC5tI0t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.11.89.175
country_id: 3923057
description:
2025-11-19 01:44:50 dovecot_login authenticator failed for host-190-11-89-175.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [190.11.89.175]:2712: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-11-19 01:45:15 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:47846: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 01:52:55 host2 sshd[3914413]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.199
country_id: 798544
description:
Nov 19 01:53:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=89.107.155.199, lip=66.85.158.91, TLS, session=<wu/0OeRD74lZa5vH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.29.55
country_id: 3469034
description:
Nov 19 01:53:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=192.140.29.55, lip=66.85.158.91, TLS, session=<a5SCO+RD+LLAjB03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:53:59 host2 sshd[3915111]: Disconnected from invalid user eagle 103.13.206.142 port 42512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:56:09 host2 sshd[3917363]: Disconnected from invalid user elastic 103.13.206.142 port 55590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:57:51 host2 sshd[3918292]: Disconnected from invalid user teamspeak3 103.13.206.142 port 53570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 19 01:58:04 host2 sshd[3918347]: Disconnected from invalid user elastic 45.78.193.188 port 53510 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.147.33.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 12.147.33.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.188.112.212
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.188.112.212 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.186.161.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 70.186.161.101 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.52.85.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.52.85.39 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.198.3.123
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.198.3.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.213.217
country_id: 3865483
description:
2025-11-19 01:58:59 dovecot_plain authenticator failed for ([31.57.166.48]) [45.173.213.217]:48891: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.247.130.144
country_id: 6252001
description:
2025-11-19 01:59:10 dovecot_plain authenticator failed for c-73-247-130-144.hsd1.il.comcast.net ([31.57.166.48]) [73.247.130.144]:42800: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.75.223.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.75.223.214 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.170
country_id: 3658394
description:
2025-11-19 01:59:24 dovecot_plain authenticator failed for ([31.57.166.48]) [181.199.46.170]:40633: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 19 01:59:38 host2 sshd[3919321]: Disconnected from invalid user administrator 103.13.206.142 port 37780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.15
country_id: 6252001
description:
Nov 19 02:05:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.15, lip=66.85.158.92, session=<KgC+aORD5P+TuYQP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 19 02:08:24 host2 sshd[3926315]: Disconnected from invalid user db2inst1 45.78.193.188 port 55656 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.35.59.117
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.35.59.117 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.224.68.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.224.68.224 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.122.52.118
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.122.52.118 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.196.83
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.118.196.83 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.168.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.46.168.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.174.213.111
country_id: 298795
description:
2025-11-19 02:11:39 dovecot_plain authenticator failed for ([31.57.166.48]) [78.174.213.111]:23900: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.59.238.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.59.238.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.229.186.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.229.186.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.129.210
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.34.129.210 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 19 02:11:13 host2 sshd[3928692]: Disconnected from invalid user ftpuser 45.78.193.188 port 60038 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.252.60.156
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.252.60.156 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.227.97.224
country_id: 3895114
description:
2025-11-19 02:12:01 dovecot_plain authenticator failed for ([31.57.166.48]) [148.227.97.224]:7190: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.88.27.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.88.27.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.64.70.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.64.70.102 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.211.133.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.211.133.177 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.131.153.248
country_id: 6252001
description:
2025-11-19 02:11:50 dovecot_plain authenticator failed for h69-131-153-248.mdtnwi.broadband.dynamic.tds.net ([31.57.166.48]) [69.131.153.248]:40951: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.130
country_id: 6252001
description:
Nov 19 02:15:43 host2 pure-ftpd[3933668]: (?@198.235.24.130) [INFO] New connection from 198.235.24.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.122
country_id: 1819730
description:
Nov 19 02:16:15 host2 sshd[3933994]: Disconnected from invalid user sonar 101.36.124.122 port 39080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.188
country_id: 1880251
description:
Nov 19 02:18:45 host2 sshd[3935473]: Disconnected from invalid user light 45.78.193.188 port 51520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.122
country_id: 1819730
description:
Nov 19 02:18:50 host2 sshd[3935537]: Disconnected from invalid user ftpuser 101.36.124.122 port 46476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-19 02:20:53 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:46820: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.135.166
country_id: 1820814
description:
2025-11-19 02:21:15 dovecot_login authenticator failed for (166-135.adsl.static.espeed.com.bn) [119.160.135.166]:53172: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.202
country_id: 6252001
description:
Nov 19 02:21:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VIUToeRDfcjG6xjK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.165.53.188
country_id: 3017382
description:
2025-11-19 02:25:50 dovecot_plain authenticator failed for 91-165-53-188.subs.proxad.net ([31.57.166.48]) [91.165.53.188]:54694: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.124.226
country_id: 3469034
description:
2025-11-19 02:26:03 dovecot_plain authenticator failed for ([31.57.166.48]) [138.59.124.226]:51104: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-19 02:26:41 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:51320: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-19 02:26:58 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:59875: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.0.96.223
country_id: 3469034
description:
2025-11-19 02:26:13 dovecot_plain authenticator failed for 138-0-96-223.megaconexao.inf.br ([31.57.166.48]) [138.0.96.223]:41161: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.124.226
country_id: 3469034
description:
2025-11-19 02:28:52 dovecot_login authenticator failed for ([31.57.166.48]) [138.59.124.226]:51104: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.109
country_id: 6252001
description:
Nov 19 02:29:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cJVLvORDJ9zG6xht>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.75.254.211
country_id: 1733045
description:
2025-11-19 02:29:30 dovecot_plain authenticator failed for ([31.57.166.48]) [180.75.254.211]:33331: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.42.42
country_id: 3686110
description:
2025-11-19 02:29:42 dovecot_plain authenticator failed for ([31.57.166.48]) [190.61.42.42]:58870: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.81.18.67
country_id: 3077311
description:
2025-11-19 02:29:11 dovecot_plain authenticator failed for 109-81-18-67.rct.o2.cz ([31.57.166.48]) [109.81.18.67]:19335: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.59.69.63
country_id: 290557
description:
2025-11-19 02:33:29 dovecot_plain authenticator failed for bba-94-59-69-63.alshamil.net.ae ([31.57.166.48]) [94.59.69.63]:53570: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.14.247.48
country_id: 2464461
description:
2025-11-19 02:33:48 dovecot_plain authenticator failed for ([31.57.166.48]) [197.14.247.48]:58234: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.131.210.181
country_id: 6252001
description:
2025-11-19 02:33:57 dovecot_plain authenticator failed for h69-131-210-181.cncrtn.broadband.dynamic.tds.net ([31.57.166.48]) [69.131.210.181]:42019: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.9
country_id: 3865483
description:
Nov 19 02:34:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=190.181.97.9, lip=66.85.158.91, TLS, session=<nMvlz+RDo7m+tWEJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.113.114.67
country_id: 1269750
description:
Nov 19 02:35:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.113.114.67, lip=66.85.158.91, TLS, session=<Odcz0eRDvNlncXJD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.202.116
country_id: 1643084
description:
Nov 19 02:37:27 host2 sshd[3948437]: Disconnected from invalid user nominatim 103.146.202.116 port 50748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.202.116
country_id: 1643084
description:
Nov 19 02:39:09 host2 sshd[3949389]: Disconnected from invalid user homeassistant 103.146.202.116 port 37400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.111
country_id: 3469034
description:
Nov 19 02:41:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.209.243.111, lip=66.85.158.91, TLS, session=<ep/X5eRDBdS60fNv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.198
country_id: 3469034
description:
Nov 19 02:40:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.89.136.198, lip=66.85.158.91, TLS, session=<pE2Q5ORD4ai+WYjG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.146.202.116
country_id: 1643084
description:
Nov 19 02:41:57 host2 sshd[3951214]: Disconnected from invalid user ubuntu 103.146.202.116 port 57070 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.236.222.252
country_id: 6252001
description:
[2025-11-19 02:44:50 +0530] info [cpaneld] 76.236.222.252 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.47.120
country_id: 6252001
description:
[2025-11-19 02:44:54 +0530] info [cpaneld] 172.56.47.120 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.189.229
country_id: 6252001
description:
[2025-11-19 02:44:56 +0530] info [whostmgrd] 107.221.189.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.27.58
country_id: 6252001
description:
[2025-11-19 02:45:03 +0530] info [cpaneld] 24.189.27.58 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.154.62.27
country_id: 6252001
description:
[2025-11-19 02:45:05 +0530] info [cpaneld] 73.154.62.27 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.144.64.67
country_id: 6252001
description:
[2025-11-19 02:45:09 +0530] info [cpaneld] 98.144.64.67 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.23.112.123
country_id: 2510769
description:
2025-11-19 02:45:29 dovecot_plain authenticator failed for 123.red-88-23-112.staticip.rima-tde.net ([31.57.166.48]) [88.23.112.123]:55666: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.1.179
country_id: 3469034
description:
2025-11-19 02:45:41 dovecot_plain authenticator failed for ([31.57.166.48]) [190.89.1.179]:29068: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.240.162
country_id: 1733045
description:
2025-11-19 02:45:55 dovecot_plain authenticator failed for ([31.57.166.48]) [27.125.240.162]:55979: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.174.38
country_id: 3469034
description:
2025-11-19 02:50:54 dovecot_plain authenticator failed for ([31.57.166.48]) [177.22.174.38]:18752: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.109.220
country_id: 99237
description:
2025-11-19 02:51:46 dovecot_plain authenticator failed for ([31.57.166.48]) [185.181.109.220]:51360: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.91.219.218
country_id: 3469034
description:
2025-11-19 02:51:08 dovecot_plain authenticator failed for ([31.57.166.48]) [177.91.219.218]:47962: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.181.216.29
country_id: 3469034
description:
2025-11-19 02:51:21 dovecot_plain authenticator failed for ([31.57.166.48]) [168.181.216.29]:20713: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.106.47.157
country_id: 3469034
description:
2025-11-19 02:51:21 dovecot_plain authenticator failed for ([31.57.166.48]) [187.106.47.157]:9323: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.83.162.24
country_id: 3865483
description:
2025-11-19 02:51:34 dovecot_plain authenticator failed for ([31.57.166.48]) [191.83.162.24]:50754: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 02:54:47 host2 sshd[3960347]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.154.66
country_id: 690791
description:
Nov 19 02:56:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=37.221.154.66, lip=66.85.158.91, TLS, session=<fYPmG+VDHY4l3ZpC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.120
country_id: 3469034
description:
Nov 19 02:56:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.248.120, lip=66.85.158.91, TLS, session=<VKQJHeVD2om60fh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.142.162
country_id: 6252001
description:
Nov 19 03:00:26 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=68.183.142.162, lip=66.85.158.92, TLS, session=<V4AbLOVDTIdEt46i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.49.139.36
country_id: 6252001
description:
2025-11-19 03:00:54 dovecot_plain authenticator failed for ([31.57.166.48]) [216.49.139.36]:53033: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.234.126.27
country_id: 6252001
description:
2025-11-19 03:01:07 dovecot_plain authenticator failed for pool-96-234-126-27.nwrknj.fios.verizon.net ([31.57.166.48]) [96.234.126.27]:33979: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.173.87.202
country_id: 3895114
description:
2025-11-19 03:01:22 dovecot_plain authenticator failed for ([31.57.166.48]) [152.173.87.202]:45324: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.33
country_id: 1880251
description:
Nov 19 03:02:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=139.99.35.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ij6tMuVDE+uLYyMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.38
country_id: 1880251
description:
Nov 19 03:02:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=139.99.35.38, lip=66.85.158.92, TLS: Connection closed, session=<1fL1M+VDh+2LYyMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.179.67.184
country_id: 6252001
description:
2025-11-19 03:05:46 dovecot_plain authenticator failed for c-174-179-67-184.hsd1.va.comcast.net ([31.57.166.48]) [174.179.67.184]:44030: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.49.18.229
country_id: 3658394
description:
2025-11-19 03:05:57 dovecot_plain authenticator failed for corp-179-49-18-229.uio.puntonet.ec ([31.57.166.48]) [179.49.18.229]:45693: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.254.9.197
country_id: 102358
description:
2025-11-19 03:05:10 dovecot_plain authenticator failed for ([31.57.166.48]) [151.254.9.197]:5704: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.206.80.24
country_id: 298795
description:
2025-11-19 03:05:22 dovecot_plain authenticator failed for ([31.57.166.48]) [31.206.80.24]:17659: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.174.124.132
country_id: 3865483
description:
2025-11-19 03:05:35 dovecot_plain authenticator failed for ([31.57.166.48]) [190.174.124.132]:53243: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.88.38.46
country_id: 298795
description:
2025-11-19 03:05:36 dovecot_plain authenticator failed for ([31.57.166.48]) [176.88.38.46]:15496: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 03:06:27 host2 sshd[3968409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.124.190.214
country_id: 3469034
description:
2025-11-19 03:08:55 dovecot_plain authenticator failed for ([31.57.166.48]) [190.124.190.214]:19453: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.4.77.9
country_id: 3469034
description:
2025-11-19 03:09:08 dovecot_plain authenticator failed for ([31.57.166.48]) [201.4.77.9]:37488: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 03:09:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52808: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.208.141.198
country_id: 2245662
description:
2025-11-19 03:09:20 dovecot_plain authenticator failed for ([31.57.166.48]) [41.208.141.198]:6824: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.86.57.122
country_id: 1282988
description:
2025-11-19 03:23:43 dovecot_plain authenticator failed for ([31.57.166.48]) [103.86.57.122]:59120: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.29.25.115
country_id: 3017382
description:
2025-11-19 03:23:56 dovecot_plain authenticator failed for 115.25.29.109.rev.sfr.net ([31.57.166.48]) [109.29.25.115]:58406: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.232.108
country_id: 3686110
description:
2025-11-19 03:23:30 dovecot_plain authenticator failed for ([31.57.166.48]) [45.65.232.108]:23073: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-19 03:26:36 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:40431: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-19 03:26:45 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:39322: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.26.48.76
country_id: 3865483
description:
2025-11-19 03:27:45 dovecot_plain authenticator failed for ([31.57.166.48]) [181.26.48.76]:59094: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.103.49.124
country_id: 3865483
description:
2025-11-19 03:27:18 dovecot_plain authenticator failed for 124-49-103-191.iparatodos.com.ar ([31.57.166.48]) [191.103.49.124]:35658: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.244.109
country_id: 1282988
description:
2025-11-19 03:27:32 dovecot_plain authenticator failed for ([31.57.166.48]) [103.225.244.109]:14103: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-19 03:29:08 dovecot_plain authenticator failed for (seleted) [91.72.153.110]:45655: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.176
country_id: 798544
description:
Nov 19 03:31:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=195.205.4.176, lip=66.85.158.91, TLS, session=<JF8TmuVDBerDzQSw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.107.193
country_id: 1269750
description:
Nov 19 03:31:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=103.87.107.193, lip=66.85.158.91, TLS, session=<Ydwzm+VD5dtnV2vB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Nov 19 03:44:16 host2 sshd[3992213]: Disconnected from invalid user sanjay 160.251.101.169 port 52828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.208
country_id: 3469034
description:
Nov 19 03:47:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=187.120.77.208, lip=66.85.158.91, TLS, session=<Q2D80+VDtLu7eE3Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.36.10
country_id: 953987
description:
Nov 19 03:48:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.36.10, lip=66.85.158.91, TLS, session=<VFo21eVDlZFmQCQK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.101.169
country_id: 1861060
description:
Nov 19 03:50:09 host2 sshd[3998138]: Disconnected from invalid user maint 160.251.101.169 port 57174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Nov 19 03:51:31 host2 sshd[3999159]: Disconnected from invalid user juan 160.251.101.169 port 34620 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 03:59:37 host2 sshd[4007135]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.47.192.106
country_id: 357994
description:
2025-11-19 04:06:10 dovecot_plain authenticator failed for (dowed) [197.47.192.106]:50680: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.161.65.9
country_id: 3077311
description:
Nov 19 04:17:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=81.161.65.9, lip=66.85.158.91, TLS, session=<KcCZPeZDvY5RoUEJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.191
country_id: 1269750
description:
Nov 19 04:17:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.84.202.191, lip=66.85.158.91, TLS, session=<Wya1PuZDgJpnVMq/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.242
country_id: 2921044
description:
Nov 19 04:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=167.172.179.242, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L9XmP+ZDiv2nrLPy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Nov 19 04:18:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<bChYQ+ZDqspnpPaX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.76
country_id: 3865483
description:
Nov 19 04:19:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=186.124.218.76, lip=66.85.158.91, TLS, session=<iEOcROZD/uC6fNpM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-19 04:21:19 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:65431: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-19 04:21:25 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:54770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-11-19 04:23:10 dovecot_plain authenticator failed for (pliked) [109.226.27.227]:60145: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.76.179
country_id: 2921044
description:
Nov 19 04:26:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.76.179, lip=66.85.158.92, session=<gu8TX+ZDdTpA4kyz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 19 04:26:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.134.101, lip=66.85.158.92, session=<JLgZX+ZDFDKl44Zl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.205.206
country_id: 6252001
description:
Nov 19 04:42:58 host2 pure-ftpd[4048718]: (?@152.32.205.206) [INFO] New connection from 152.32.205.206


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.45
country_id: 3175395
description:
Nov 19 04:45:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.169.45, lip=66.85.158.91, TLS, session=<THcnpOZDDLK5D6kt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.110.155
country_id: 3469034
description:
Nov 19 04:46:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.85.110.155, lip=66.85.158.91, TLS, session=<WwVMpeZDPK+7VW6b>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 04:49:01 host2 sshd[4052928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.212
country_id: 6252001
description:
Nov 19 04:55:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UHwhyOZDv9XN0h/U>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.234.40
country_id: 6252001
description:
Nov 19 04:57:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.234.40, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TGcA0OZDeLKhI+oo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 05:00:40 host2 sshd[4061308]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.114.175.11
country_id: 2510769
description:
Nov 19 05:02:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=185.114.175.11, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EwNY3+ZDf+i5cq8L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Nov 19 05:03:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.91, TLS, session=<9qX94uZDAuDG6xjo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Nov 19 05:06:49 host2 sshd[4065517]: Disconnected from invalid user kizzy 223.197.248.209 port 56358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Nov 19 05:10:50 host2 sshd[4068079]: Disconnected from invalid user anthony 223.197.248.209 port 34646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.101
country_id: 1643084
description:
Nov 19 05:11:20 host2 sshd[4068410]: Disconnected from invalid user rob 103.250.10.101 port 49436 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.190.16.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.190.16.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Nov 19 05:12:06 host2 sshd[4068863]: Disconnected from invalid user chrism 223.197.248.209 port 48425 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov 19 05:12:55 host2 sshd[4069434]: Disconnected from invalid user ghost 103.250.10.101 port 59278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Nov 19 05:13:16 host2 sshd[4069742]: Disconnected from invalid user compras 223.197.248.209 port 33965 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.128.110.62
country_id: 953987
description:
Nov 19 05:13:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.128.110.62, lip=66.85.158.91, TLS, session=<iMbrBedDKJJmgG4+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.230
country_id: 953987
description:
Nov 19 05:13:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.35.230, lip=66.85.158.91, TLS, session=<GrheB+dDvspmQCPm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.70
country_id: 732800
description:
Nov 19 05:14:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.253.159.70, lip=66.85.158.91, TLS, session=<5ZKDC+dD+qa5/Z9G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.166
country_id: 953987
description:
Nov 19 05:15:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=102.129.53.166, lip=66.85.158.91, TLS, session=<Nn2pDOdDSq9mgTWm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 19 05:15:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<E/6zDudD5vhChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov 19 05:14:27 host2 sshd[4070381]: Disconnected from invalid user ubuntu 103.250.10.101 port 49760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.248.209
country_id: 1819730
description:
Nov 19 05:15:37 host2 sshd[4071248]: Disconnected from invalid user sabina 223.197.248.209 port 33282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.114.196
country_id: 3923057
description:
Nov 19 05:22:17 host2 sshd[4075208]: Disconnected from invalid user sanjay 190.129.114.196 port 40344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.114.196
country_id: 3923057
description:
Nov 19 05:26:48 host2 sshd[4078006]: Disconnected from invalid user user1 190.129.114.196 port 37986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.114.196
country_id: 3923057
description:
Nov 19 05:28:18 host2 sshd[4078833]: Disconnected from invalid user frontend 190.129.114.196 port 55944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.141.6
country_id: 3469034
description:
Nov 19 05:42:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.190.141.6, lip=66.85.158.91, TLS, session=<2pKPbedD9buxvo0G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.247
country_id: 3469034
description:
Nov 19 05:41:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.53.128.247, lip=66.85.158.91, TLS, session=<ZuJabOdDy6O/NYD3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 19 05:50:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, TLS: Connection closed, session=<nbEpjOdDYrhChJmB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-19 06:00:36 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:44878: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-19 06:01:28 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:40218: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 19 06:06:12 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, TLS, session=<9Uh1xOdDOrSUcdUX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.66.114.45
country_id: 1269750
description:
Nov 19 06:09:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.66.114.45, lip=66.85.158.91, TLS, session=<rniZzudD0LNnQnIt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.207
country_id: 3469034
description:
Nov 19 06:09:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.136.207, lip=66.85.158.91, TLS, session=<tXXHz+dDmre+WYjP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.27
country_id: 6252001
description:
Nov 19 06:09:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.27, lip=66.85.158.92, TLS, session=<pKgo0edD2u7N0h8b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-11-19 06:09:53 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:52535: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.69
country_id: 1605651
description:
2025-11-19 06:10:23 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.69]:41708: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.20
country_id: 1269750
description:
Nov 19 06:11:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=103.25.132.20, lip=66.85.158.91, TLS, session=</ZRt1OdDaNlnGYQU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.111.8
country_id: 798544
description:
Nov 19 06:11:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=91.196.111.8, lip=66.85.158.91, TLS, session=<XY6r1edD7IJbxG8I>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.159.99.95
country_id: 2750405
description:
Nov 19 06:19:45 host2 pure-ftpd[4112481]: (?@192.159.99.95) [INFO] New connection from 192.159.99.95


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 19 06:24:55 host2 sshd[4116036]: Disconnected from invalid user pivpn 103.218.240.181 port 60334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 19 06:26:14 host2 sshd[4117806]: Disconnected from invalid user zero 103.218.240.181 port 48918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 19 06:30:11 host2 sshd[4120423]: Disconnected from invalid user global 103.218.240.181 port 37972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.45.167.104
country_id: 2510769
description:
Nov 19 06:37:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=5.45.167.104, lip=66.85.158.91, TLS, session=<XJkNNehDQ4gFLado>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.54
country_id: 1269750
description:
Nov 19 06:38:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.59.134.54, lip=66.85.158.91, TLS, session=<siYyNuhDmbZnO4Y2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 06:43:19 host2 sshd[4132053]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 19 06:53:16 host2 sshd[4138409]: Disconnected from invalid user test5 190.129.122.12 port 33639 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.14.131
country_id: 3469034
description:
Nov 19 06:53:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.72.14.131, lip=66.85.158.91, TLS, session=<33j+bOhDVJCxSA6D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.144.64
country_id: 690791
description:
Nov 19 06:53:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.144.64, lip=66.85.158.91, TLS, session=<TukobuhDne0l3ZBA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 06:54:59 host2 sshd[4140130]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 19 06:56:51 host2 sshd[4141383]: Disconnected from invalid user dev 188.166.159.88 port 55444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 19 06:58:48 host2 sshd[4142623]: Disconnected from invalid user contest 188.166.159.88 port 37200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 19 07:00:26 host2 sshd[4144135]: Disconnected from invalid user adam 190.129.122.12 port 1423 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov 19 07:01:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, session=<tfF2iuhDFo7LN4MD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 19 07:01:55 host2 sshd[4144906]: Disconnected from invalid user kiran 188.166.159.88 port 57834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 19 07:03:56 host2 sshd[4146376]: Disconnected from invalid user emo 188.166.159.88 port 48372 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 19 07:04:44 host2 sshd[4146976]: Disconnected from invalid user ubuntu 190.129.122.12 port 49478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-19 07:05:52 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:64812: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-19 07:06:16 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:42240: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 07:05:33 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57230: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-11-19 07:06:55 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (repolled) [98.196.209.55]:54036: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 19 07:07:51 host2 sshd[4148900]: Disconnected from invalid user desktop 190.129.122.12 port 17348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.23
country_id: 3017382
description:
2025-11-19 07:08:11 dovecot_login authenticator failed for ([188.231.3.23]) [188.231.3.23]:35433: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-11-19 07:08:26 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:56762: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-19 07:14:40 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:33596: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:14:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iFp0uuhDCoIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-19 07:15:14 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:42708: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:15:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<obZdvehD5pUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:16:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<NOV1wOhDfroDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:18:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NPf8xuhDcOMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:20:10 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<iob7zOhD4s4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:21:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eenO0OhDPtkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:23:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<bH0n1+hDMuwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-19 07:26:02 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (overs) [68.82.141.145]:38958: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:25:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<taz/3uhDSoEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 19 07:26:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<dOmP5OhDhIkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.162.99.230
country_id: 3077311
description:
Nov 19 07:33:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=192.162.99.230, lip=66.85.158.91, TLS, session=<HErP++hDZ8DAomPm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.70
country_id: 798544
description:
Nov 19 07:33:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=109.125.248.70, lip=66.85.158.91, TLS, session=<8FDe/OhDibxtffhG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-11-19 07:34:22 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:41495: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-19 07:35:14 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:35410: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.41
country_id: 3175395
description:
Nov 19 07:49:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.170.41, lip=66.85.158.91, TLS, session=<B30tNulDEIm5D6op>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.73.219
country_id: 3469034
description:
Nov 19 07:49:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.190.73.219, lip=66.85.158.91, TLS, session=<81f2NOlDjZSxvknb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-11-19 07:52:23 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:46028: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-11-19 07:53:00 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:43546: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-19 07:53:11 dovecot_login authenticator failed for ([61.12.86.92]) [61.12.86.90]:44798: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 19 07:54:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V6zASOlDBN5ChJlw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 07:56:11 host2 sshd[4181141]: Disconnected from invalid user admin 172.190.117.128 port 43882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-11-19 07:58:19 dovecot_login authenticator failed for ([154.144.255.208]) [154.144.255.208]:52086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-19 07:58:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:51914: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 07:58:42 host2 sshd[4182490]: Disconnected from invalid user alex 172.190.117.128 port 39870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 07:59:59 host2 sshd[4183348]: Disconnected from invalid user postgres 172.190.117.128 port 48178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 19 08:00:53 host2 sshd[4184085]: Disconnected from invalid user postgres 79.6.62.97 port 59952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 08:01:19 host2 sshd[4184309]: Disconnected from invalid user victor 172.190.117.128 port 50646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.128
country_id: 3175395
description:
Nov 19 08:03:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.170.128, lip=66.85.158.91, TLS, session=<7Gg9Z+lD3+S5D6qA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.235
country_id: 3469034
description:
Nov 19 08:03:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=187.120.106.235, lip=66.85.158.91, TLS, session=<t7lcaOlD/5S7eGrr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov 19 08:05:21 host2 sshd[4187165]: Disconnected from invalid user ahsan 172.190.117.128 port 35114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 19 08:06:07 host2 sshd[4187546]: Disconnected from invalid user luke 79.6.62.97 port 54130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-19 08:09:21 dovecot_plain authenticator failed for (bliked) [65.20.205.197]:34618: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.109
country_id: 3865483
description:
Nov 19 08:13:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.195.109, lip=66.85.158.91, TLS, session=<rK0QjOlDxti14cNt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.92
country_id: 3469034
description:
Nov 19 08:14:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=200.196.143.92, lip=66.85.158.91, TLS, session=<TOJsjelDl8jIxI9c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 19 08:14:35 host2 sshd[4192103]: Disconnected from invalid user victor 79.6.62.97 port 49204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-19 08:19:24 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:56860: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-19 08:19:52 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:45286: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.35
country_id: 798544
description:
Nov 19 08:23:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=128.127.94.35, lip=66.85.158.91, TLS, session=<+I5FrulDLbiAf14j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.48
country_id: 3175395
description:
Nov 19 08:23:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.48, lip=66.85.158.91, TLS, session=<+bJRr+lDtKWrFusw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-11-19 08:26:00 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:57148: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-19 08:25:42 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:52772: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Nov 19 08:27:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS: Connection closed, session=<oKK9vOlDtEynXpIz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 19 08:31:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<UdfLy+lDmqeLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2025-11-19 08:34:19 dovecot_login authenticator failed for (red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:58387: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-19 08:34:49 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:33778: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 08:37:51 host2 sshd[13434]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 08:49:32 host2 sshd[23736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 19 08:52:26 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<myTuFupD0OMs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-19 09:16:44 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:58568: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-11-19 09:16:57 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:50500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.84
country_id: 2510769
description:
Nov 19 09:25:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.229.98.84, lip=66.85.158.91, TLS, session=<9jXXjepDRKy55WJU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.212
country_id: 3469034
description:
Nov 19 09:26:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.212, lip=66.85.158.91, TLS, session=<uFvwjupDeuC+WYjU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.158
country_id: 3865483
description:
Nov 19 09:27:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.181.101.158, lip=66.85.158.91, TLS, session=<u76Uk+pDwJ2+tWWe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.34
country_id: 3469034
description:
Nov 19 09:28:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=177.93.165.34, lip=66.85.158.91, TLS, session=<V2xxlepDH8axXaUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.169
country_id: 6252001
description:
Nov 19 09:29:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.169, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4iOgm+pDHt+TuYWp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.96.38
country_id: 2750405
description:
Nov 19 09:32:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.96.38, lip=66.85.158.92, session=<66g5pupDvsnRJmAm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:33:22 host2 sshd[52970]: Disconnected from invalid user test 103.210.22.105 port 46240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 19 09:34:10 host2 sshd[53378]: Disconnected from invalid user john 125.31.2.160 port 58850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 19 09:36:02 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<XQHcsupD7rsD7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.169
country_id: 6252001
description:
Nov 19 09:35:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.169, lip=66.85.158.91, TLS, session=<5+BosepDNvyTuYWp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:36:32 host2 sshd[54837]: Disconnected from invalid user md 103.210.22.105 port 36604 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:38:03 host2 sshd[55850]: Disconnected from invalid user zt 103.210.22.105 port 49172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Nov 19 09:39:34 host2 sshd[56715]: Disconnected from invalid user sysadmin 103.210.22.105 port 51436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 19 09:40:36 host2 sshd[57547]: Disconnected from invalid user zt 125.31.2.160 port 60746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.219.121
country_id: 2750405
description:
Nov 19 09:52:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.219.121, lip=66.85.158.91, session=<ruba7OpD0NukXNt5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.111
country_id: 3175395
description:
Nov 19 09:54:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.234.111, lip=66.85.158.91, TLS, session=<h7xg9OpD1tKrFupv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.48
country_id: 798544
description:
Nov 19 09:54:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.29.48, lip=66.85.158.91, TLS, session=<8yGZ9epDpJiy2B0w>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-19 09:56:42 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:36691: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-19 09:57:00 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:37899: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PaMVDOtDod6i2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:02:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<fjnnD+tDpPOi2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:02:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<O7S6EOtDiu2i2Jb5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 19 10:07:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=66.85.158.91, TLS: Connection closed, session=<WcRqIutD1MlHBobp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.40.130
country_id: 226074
description:
Nov 19 10:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=196.0.40.130, lip=66.85.158.91, TLS, session=<9G7RKOtDF4PEACiC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.211.108
country_id: 3865483
description:
Nov 19 10:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.1.211.108, lip=66.85.158.91, TLS, session=</JcjKutDNpa6AdNs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.249
country_id: 6252001
description:
Nov 19 10:09:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.249, lip=66.85.158.92, TLS, session=<Gy2WKetDPP2i2Jb5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:10:37 host2 sshd[78432]: Disconnected from invalid user peter 178.128.147.10 port 34710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:11:06 host2 sshd[78822]: Disconnected from invalid user trial 45.81.23.80 port 32906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:14:37 host2 sshd[81201]: Disconnected from invalid user alexis 178.128.147.10 port 37584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.233
country_id: 6252001
description:
Nov 19 10:14:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fPajPetDO8TG6xjp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:15:52 host2 sshd[82023]: Disconnected from invalid user server 45.81.23.80 port 53348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 19 10:16:50 host2 sshd[82738]: Disconnected from invalid user jona 165.154.1.18 port 56166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:18:07 host2 sshd[83390]: Disconnected from invalid user ca 86.107.77.91 port 40432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:18:08 host2 sshd[83400]: Disconnected from invalid user vpsuser 178.128.147.10 port 35150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-19 10:19:01 dovecot_plain authenticator failed for (prowns) [94.204.236.202]:51310: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 19 10:19:12 host2 sshd[84004]: Disconnected from invalid user admin2 178.128.147.10 port 53664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:20:14 host2 sshd[84913]: Disconnected from invalid user backup 86.107.77.91 port 37376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.80
country_id: 2750405
description:
Nov 19 10:21:58 host2 sshd[85939]: Disconnected from invalid user mep 45.81.23.80 port 48036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.91
country_id: 2921044
description:
Nov 19 10:21:17 host2 sshd[85490]: Disconnected from invalid user user1 86.107.77.91 port 45252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 19 10:23:19 host2 sshd[86817]: Disconnected from invalid user user1 165.154.1.18 port 33238 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 19 10:25:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<MFoYY+tDEA1APsUR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.53
country_id: 953987
description:
Nov 19 10:26:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.41.53, lip=66.85.158.91, TLS, session=<cCJIZutDj7dmQCk1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.241
country_id: 6252001
description:
Nov 19 10:26:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.241, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TJC7aOtDos3N0h/x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.239
country_id: 3865483
description:
Nov 19 10:26:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.177.200.239, lip=66.85.158.91, TLS, session=<4eSQZ+tDfL8tscjv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.59.91.71
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.59.91.71 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:36:33 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<v1ZKi+tDTtIDg9cm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.143.196.159
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.143.196.159 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.53.219.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 50.53.219.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.4.249.101
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.4.249.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.7.131.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.7.131.116 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.51.241.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.51.241.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.65.194
country_id: 1210997
description:
2025-11-19 10:37:30 dovecot_plain authenticator failed for ([31.57.166.48]) [103.112.65.194]:36120: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.159.105.190
country_id: 1733045
description:
2025-11-19 10:37:48 dovecot_plain authenticator failed for ([31.57.166.48]) [110.159.105.190]:51435: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:37:18 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<Hbf2jetDRq4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.235.19.215
country_id: 3469034
description:
2025-11-19 10:38:08 dovecot_plain authenticator failed for ([31.57.166.48]) [177.235.19.215]:34639: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:39:17 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<M4kLletDHoUDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.161
country_id: 3469034
description:
Nov 19 10:41:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=191.53.128.161, lip=66.85.158.91, TLS, session=<wbd8mutDRIC/NYCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:40:07 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<uGYJmOtD4qQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:41:32 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<mAAXnetDWJMDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.135
country_id: 3175395
description:
Nov 19 10:41:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=217.26.178.135, lip=66.85.158.91, TLS, session=<qFSmm+tDsr/ZGrKH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:41:26 host2 sshd[98784]: Disconnected from invalid user calvin 182.253.238.218 port 45509 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:43:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<LLXvpOtD3OUDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:43:58 host2 sshd[100337]: Disconnected from invalid user sql 182.253.238.218 port 38120 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:44:15 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=</AXSputDAsMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:44:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<emv1p+tDjNUDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Nov 19 10:45:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<biPMrOtD68TG6xjy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:46:29 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<mnPJrutDbNwDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.91
country_id: 3017382
description:
2025-11-19 10:46:44 dovecot_plain authenticator failed for ([10.22.18.159]) [203.188.183.91]:7519: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 19 10:47:11 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<xwVSsetDwooDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:48:21 host2 sshd[103401]: Disconnected from invalid user admin 182.253.238.218 port 53328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:49:46 host2 sshd[104181]: Disconnected from invalid user marcel 182.253.238.218 port 39568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.238.218
country_id: 1643084
description:
Nov 19 10:51:12 host2 sshd[105177]: Disconnected from invalid user ubuntu 182.253.238.218 port 54044 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Nov 19 10:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.91, session=<bfpww+tDjKel4z73>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:53:41 host2 sshd[106386]: Disconnected from invalid user abhishek 43.225.158.169 port 38158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-19 10:54:24 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:20217: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-19 10:54:46 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:50983: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.189.195
country_id: 1643084
description:
2025-11-19 10:55:13 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:42447: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:56:08 host2 sshd[108592]: Disconnected from invalid user admin 43.225.158.169 port 58122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.225.158.169
country_id: 1819730
description:
Nov 19 10:57:28 host2 sshd[109286]: Disconnected from invalid user botuser 43.225.158.169 port 43968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 19 10:59:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, TLS, session=<2GrF2+tDZocD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:01:22 host2 sshd[111413]: Disconnected from invalid user gerencia 50.225.176.238 port 50250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 11:03:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57257: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:04:48 host2 sshd[113794]: Disconnected from invalid user gp 50.225.176.238 port 33172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:07:11 host2 sshd[115404]: Disconnected from invalid user techuser 101.36.119.218 port 42298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:09:24 host2 sshd[116885]: Disconnected from invalid user techuser 50.225.176.238 port 50534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:12:00 host2 sshd[118845]: Disconnected from invalid user hossein 101.36.119.218 port 59582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Nov 19 11:13:16 host2 sshd[120211]: Disconnected from invalid user kyu 50.225.176.238 port 41078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:16:59 host2 sshd[123343]: Disconnected from invalid user es 101.36.119.218 port 48234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Nov 19 11:18:17 host2 sshd[124296]: Disconnected from invalid user testserver 101.36.119.218 port 47274 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 19 11:23:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<wmldNOxDiPenXpI7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Nov 19 11:30:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.40, lip=66.85.158.91, TLS, session=<mlBkS+xDKPTN0h8o>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 19 11:30:56 host2 pure-ftpd[134133]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 19 11:30:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS, session=</NjHTexDLpozn+p2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:31:50 host2 sshd[134809]: Disconnected from invalid user wl 103.101.225.22 port 49454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.237
country_id: 3865483
description:
Nov 19 11:32:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.122.128.237, lip=66.85.158.91, TLS, session=<qRZWUuxD5si+eoDt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.158
country_id: 3865483
description:
Nov 19 11:32:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.181.101.158, lip=66.85.158.91, TLS, session=<oF+8U+xDWsy+tWWe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.113
country_id: 2963597
description:
Nov 19 11:34:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=37.203.49.113, lip=66.85.158.91, TLS, session=<ain1V+xDDJslyzFx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.171
country_id: 3469034
description:
Nov 19 11:34:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=200.196.143.171, lip=66.85.158.91, TLS, session=<UL2lWexDIozIxI+r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.154
country_id: 6252001
description:
Nov 19 11:35:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.154, lip=66.85.158.92, TLS, session=<3yJrXexD3IEUQGia>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 19 11:35:57 host2 sshd[137096]: Disconnected from invalid user user 190.167.237.191 port 43314 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.16
country_id: 6252001
description:
Nov 19 11:36:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=742) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=40.124.175.16, lip=66.85.158.91, TLS: read(size=742) failed: Connection reset by peer, session=<Ez5TYexDPJ8ofK8Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.237
country_id: 6252001
description:
Nov 19 11:39:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.237, lip=66.85.158.92, session=<xk5YbOxDrM+H7X3t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 19 11:39:33 host2 sshd[139141]: Disconnected from invalid user discord 190.167.237.191 port 46810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Nov 19 11:40:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r9BabuxDG8XN0h/P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:40:20 host2 sshd[139739]: Disconnected from invalid user filezilla 103.101.225.22 port 33028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:40:07 host2 sshd[139525]: Disconnected from invalid user usr1cv8 27.254.149.199 port 52044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:41:39 host2 sshd[140592]: Disconnected from invalid user willem 103.101.225.22 port 45254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:43:03 host2 sshd[141390]: Disconnected from invalid user diego 103.101.225.22 port 58518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.104.209
country_id: 3469034
description:
Nov 19 11:45:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=191.240.104.209, lip=66.85.158.91, TLS, session=<PlCxgOxDo5S/8GjR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.43
country_id: 798544
description:
Nov 19 11:45:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training>, method=PLAIN, rip=91.246.213.43, lip=66.85.158.91, TLS, session=<W1HggexDEpxb9tUr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:46:25 host2 sshd[143847]: Disconnected from invalid user andy 27.254.149.199 port 50474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:47:46 host2 sshd[144683]: Disconnected from invalid user ftp1 27.254.149.199 port 52492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.225.22
country_id: 1643084
description:
Nov 19 11:47:52 host2 sshd[144731]: Disconnected from invalid user helene 103.101.225.22 port 48750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 19 11:50:04 host2 sshd[146045]: Disconnected from invalid user web 154.219.97.8 port 33722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 19 11:52:06 host2 sshd[147458]: Disconnected from invalid user manish 27.254.149.199 port 58570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 19 11:53:18 host2 sshd[148375]: Disconnected from invalid user admin 154.219.97.8 port 34208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 19 11:53:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, TLS handshaking: Connection closed, session=<apy1nuxDrl1ChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-11-19 11:55:22 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:42880: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.33.131
country_id: 3865483
description:
Nov 19 12:01:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.227.33.131, lip=66.85.158.91, TLS, session=<GEe7uOxDrcgt4yGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.185
country_id: 1269750
description:
Nov 19 12:01:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=103.18.166.185, lip=66.85.158.91, TLS, session=<85hQuuxD4rtnEqa5>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.184.139
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.80.184.139 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.134
country_id: 6252001
description:
Nov 19 12:11:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.134, lip=66.85.158.92, TLS: Connection closed, session=<vTYT3+xDjJXHLZqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.180
country_id: 6252001
description:
Nov 19 12:21:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.180, lip=66.85.158.91, session=<c42YAe1D1OoUQcK0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:27:41 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<cvazGO1D3p0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.250.44
country_id: 2921044
description:
Nov 19 12:27:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.250.44, lip=66.85.158.92, TLS, session=<BPDfGO1DlmqkXPos>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:28:31 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<PMK9G+1DDKUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.151
country_id: 3469034
description:
Nov 19 12:29:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.247.151, lip=66.85.158.91, TLS, session=<QzzhHe1DYtm60feX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.222
country_id: 690791
description:
Nov 19 12:29:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=37.221.134.222, lip=66.85.158.91, TLS, session=<LwcfH+1Diqol3Ybe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:31:04 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<k4DaJO1DkOADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:31:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<6PtxJ+1DlIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:32:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<VBYLK+1DaroDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:32:59 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<9rCzK+1DjNYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:33:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<5u/ULe1DdtwDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:33:45 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<aj5wLu1D6MQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 19 12:34:16 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<KctJMO1DNugDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 12:35:46 host2 sshd[175843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 12:36:09 host2 sshd[176071]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 19 12:39:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<cWTAQu1DlLCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-19 12:40:53 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:33812: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-19 12:41:04 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:40274: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.228.125
country_id: 2245662
description:
Nov 19 12:41:50 host2 sshd[179545]: Disconnected from invalid user nrk 154.125.228.125 port 57384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.49
country_id: 3865483
description:
Nov 19 12:43:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.198.49, lip=66.85.158.91, TLS, session=<pgMET+1D1di14cYx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.50
country_id: 3175395
description:
Nov 19 12:43:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.208.106.50, lip=66.85.158.91, TLS, session=<7pwqUO1Dvey50Goy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.238
country_id: 3469034
description:
Nov 19 12:48:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.189.199.238, lip=66.85.158.91, TLS, session=<G+RNYu1DrY+zvcfu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.181
country_id: 690791
description:
Nov 19 12:49:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.158.181, lip=66.85.158.91, TLS, session=<xOceZO1DzZ4l3Z61>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 12:49:07 host2 sshd[184401]: Disconnected from invalid user apple 186.237.143.246 port 37904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.228.125
country_id: 2245662
description:
Nov 19 12:50:40 host2 sshd[185509]: Disconnected from invalid user login 154.125.228.125 port 37851 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 12:52:37 host2 sshd[186694]: Disconnected from invalid user ali 186.237.143.246 port 34328 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.73.204.62
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.73.204.62 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 13:01:36 host2 sshd[193409]: Disconnected from invalid user ac 186.237.143.246 port 52824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 19 13:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<Akexme1D4NgsyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 19 13:08:29 host2 sshd[197721]: Disconnected from invalid user vscode 186.237.143.246 port 36930 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.227
country_id: 2635167
description:
Nov 19 13:08:34 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.227, lip=66.85.158.91, TLS, session=<1cnqqu1Dk9+594nj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-19 13:14:41 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46676: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-19 13:14:48 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:34521: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 19 13:22:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yxKb2+1DSjhAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.55
country_id: 6252001
description:
Nov 19 13:22:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.55, lip=66.85.158.91, session=<iRm82+1DsTxAPpw3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.52
country_id: 6252001
description:
Nov 19 13:22:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.52, lip=66.85.158.91, TLS: Connection closed, session=<9Al03O1D4DFAPpw0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-11-19 13:24:47 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:55355: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-19 13:25:17 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:43640: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-19 13:25:19 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:52586: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-19 13:25:46 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:60348: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:33:28 host2 sshd[213238]: Disconnected from invalid user hp 152.32.174.199 port 38682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 19 13:35:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, TLS: Connection closed, session=<IJqmDO5DgMrCpGsE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:35:55 host2 sshd[215175]: Disconnected from invalid user postgres 152.32.174.199 port 41220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.117
country_id: 3175395
description:
Nov 19 13:39:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.15.171.117, lip=66.85.158.91, TLS, session=<IRqtF+5DOeq5D6t1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.41
country_id: 3865483
description:
Nov 19 13:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.193.41, lip=66.85.158.91, TLS, session=<vSTSGO5D9Nm6YMEp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.185
country_id: 3469034
description:
Nov 19 13:41:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.89.136.185, lip=66.85.158.91, TLS, session=<pQ4LHu5D19y+WYi5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Nov 19 13:40:53 host2 sshd[218433]: Disconnected from invalid user user2 152.32.174.199 port 38856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.23
country_id: 798544
description:
Nov 19 13:41:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=91.246.105.23, lip=66.85.158.91, TLS, session=<lA8xH+5D6eJb9mkX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:43:40 host2 sshd[219973]: Disconnected from invalid user deleteme 200.118.99.170 port 54942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:46:08 host2 sshd[222026]: Disconnected from invalid user pentest 200.118.99.170 port 53804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:47:22 host2 sshd[222860]: Disconnected from invalid user gokul 200.118.99.170 port 53234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov 19 13:49:45 host2 sshd[224218]: Disconnected from invalid user monika 200.118.99.170 port 52090 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Nov 19 13:57:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.91, session=<2EVkWe5D0ubG6xh2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 19 14:02:46 host2 sshd[233063]: Disconnected from invalid user cmm 162.241.87.197 port 37112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 19 14:05:45 host2 sshd[235462]: Disconnected from invalid user arif 162.241.87.197 port 53032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
country_id: 290557
description:
2025-11-19 14:07:23 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:39064: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-19 14:07:32 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:55441: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.91
country_id: 798544
description:
Nov 19 14:08:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=46.20.58.91, lip=66.85.158.91, TLS, session=<KiGIfu5DVMEuFDpb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.28
country_id: 1269750
description:
Nov 19 14:08:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.104.127.28, lip=66.85.158.91, TLS, session=<q0+rf+5DPuZnaH8c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 19 14:08:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.92, TLS, session=<hKARge5Dgu3G6xhl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 19 14:11:42 host2 sshd[239130]: Disconnected from invalid user db 103.49.239.77 port 40824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.72
country_id: 1643084
description:
Nov 19 14:11:59 host2 sshd[239292]: Disconnected from invalid user tarsys 103.146.203.72 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:12:07 host2 sshd[239396]: Disconnected from invalid user julien 152.32.239.90 port 17146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.125.229
country_id: 6252001
description:
Nov 19 14:12:23 host2 pure-ftpd[239592]: (?@134.122.125.229) [INFO] New connection from 134.122.125.229


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 19 14:13:14 host2 sshd[240202]: Disconnected from invalid user ssd 103.49.239.77 port 40248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.203.72
country_id: 1643084
description:
Nov 19 14:13:18 host2 sshd[240237]: Disconnected from invalid user ssd 103.146.203.72 port 50008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:13:29 host2 sshd[240316]: Disconnected from invalid user l4d2 152.32.239.90 port 45434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 19 14:19:52 host2 sshd[244652]: Disconnected from invalid user ubuntu 152.32.239.90 port 21868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:22:33 host2 sshd[246500]: Disconnected from invalid user web 117.252.95.54 port 46878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:23:44 host2 sshd[247334]: Disconnected from invalid user ftpuser 165.154.170.25 port 52582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:24:06 host2 sshd[247593]: Disconnected from invalid user librenms 117.252.95.54 port 59192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.222.53
country_id: 1880251
description:
Nov 19 14:24:41 host2 sshd[247993]: Disconnected from invalid user ryan 152.42.222.53 port 37164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:27:50 host2 sshd[250333]: Disconnected from invalid user seekcy 165.154.170.25 port 57352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.222.53
country_id: 1880251
description:
Nov 19 14:28:59 host2 sshd[251136]: Disconnected from invalid user palserver 152.42.222.53 port 38688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:28:42 host2 sshd[250995]: Disconnected from invalid user ubuntu 117.252.95.54 port 64402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:30:07 host2 sshd[251992]: Disconnected from invalid user dos 117.252.95.54 port 8346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:30:32 host2 sshd[252283]: Disconnected from invalid user ftptest2 165.154.170.25 port 37534 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 14:31:51 host2 sshd[253126]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.252
country_id: 6252001
description:
Nov 19 14:32:02 host2 pure-ftpd[253270]: (?@184.105.247.252) [INFO] New connection from 184.105.247.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 14:32:14 host2 sshd[253412]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.252.95.54
country_id: 1269750
description:
Nov 19 14:32:56 host2 sshd[253898]: Disconnected from invalid user usuario1 117.252.95.54 port 28637 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 19 14:37:23 host2 sshd[256743]: Disconnected from invalid user lighthouse 165.154.170.25 port 41646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.38
country_id: 298795
description:
Nov 19 14:40:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=95.0.171.38, lip=66.85.158.91, TLS, session=<dfHH8+5D0ctfAKsm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.121
country_id: 3175395
description:
Nov 19 14:40:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.197.9.121, lip=66.85.158.91, TLS, session=<716o8u5DAq+5xQl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-19 14:44:38 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:55770: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.111
country_id: 3469034
description:
Nov 19 14:45:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=186.216.88.111, lip=66.85.158.91, TLS, session=<5bGvAu9DNp262Fhv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.244
country_id: 798544
description:
Nov 19 14:45:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.20.58.244, lip=66.85.158.91, TLS, session=<j+7wA+9D0Z8uFDr0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 14:57:23 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60908: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 19 15:04:11 host2 sshd[274926]: Disconnected from invalid user gino 167.71.204.253 port 36712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Nov 19 15:05:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<+D3QTO9DVoc26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.88
country_id: 6252001
description:
Nov 19 15:05:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.88, lip=66.85.158.92, session=<csYuTu9D/+HDuExY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.133
country_id: 6252001
description:
Nov 19 15:05:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.133, lip=66.85.158.92, session=<kJjJTu9DCdPDuEyF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.135
country_id: 6252001
description:
Nov 19 15:06:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.135, lip=66.85.158.92, session=<FEZxT+9DKZPDuEyH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.26.161
country_id: 798544
description:
Nov 19 15:06:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.216.26.161, lip=66.85.158.91, TLS, session=<VBI4Ue9DFrKy2Bqh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.82
country_id: 1269750
description:
Nov 19 15:07:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.18.166.82, lip=66.85.158.91, TLS, session=<24BeUu9DU65nEqZS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:08:32 host2 sshd[277642]: Disconnected from invalid user wangjian 87.120.219.216 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:10:29 host2 sshd[278886]: Disconnected from invalid user andrew 87.120.219.216 port 41742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Nov 19 15:10:51 host2 sshd[279137]: Disconnected from invalid user postgres 167.71.204.253 port 41266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.120.219.216
country_id: 2635167
description:
Nov 19 15:14:24 host2 sshd[281981]: Disconnected from invalid user postgres 87.120.219.216 port 43592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-19 15:26:00 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:50188: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-19 15:27:00 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:53026: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-19 15:26:33 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:55396: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.250.2
country_id: 99237
description:
Nov 19 15:35:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=65.20.250.2, lip=66.85.158.91, TLS, session=<FXylte9Dw9xBFPoC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.239.103.137
country_id: 3277605
description:
Nov 19 15:35:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=104.239.103.137, lip=66.85.158.91, TLS, session=<KmHNtu9Dt8xo72eJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:36:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<b8PFuu9D3owDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:37:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<feYfwe9DHOoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:39:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<uwVqxe9DFK4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:40:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<8bp8y+9DwKkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:42:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<G6YE0u9DqLEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 19 15:43:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=</2z70+9Dps4s3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:43:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</YP60+9DjJ0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-19 15:44:57 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:57525: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-19 15:44:40 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:58451: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 19 15:45:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<+Xpo3O9DAMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 19 15:52:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<YK2v9O9D7s02xDDo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:08:36 host2 sshd[322731]: Disconnected from invalid user nam 79.116.35.29 port 33904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:11:57 host2 sshd[325233]: Disconnected from invalid user elasticsearch 79.116.35.29 port 42594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:13:11 host2 sshd[325975]: Disconnected from invalid user ubuntu 79.116.35.29 port 42134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:17:15 host2 sshd[328647]: Disconnected from invalid user gabby 103.59.95.12 port 41724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.116.35.29
country_id: 2510769
description:
Nov 19 16:17:43 host2 sshd[328915]: Disconnected from invalid user maman 79.116.35.29 port 40292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.247
country_id: 3469034
description:
Nov 19 16:20:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.53.165.247, lip=66.85.158.91, TLS, session=<uvAWWfBDrtSxNaX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.247
country_id: 3175395
description:
Nov 19 16:21:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=171.22.235.247, lip=66.85.158.91, TLS, session=<PaZWWvBDoM6rFuv3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.32.16
country_id: 3017382
description:
Nov 19 16:21:33 host2 sshd[331312]: Disconnected from invalid user goran 146.59.32.16 port 35960 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 16:26:56 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.32.16
country_id: 3017382
description:
Nov 19 16:27:04 host2 sshd[335049]: Disconnected from invalid user client 146.59.32.16 port 36570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 16:27:34 host2 sshd[335341]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:29:17 host2 sshd[336326]: Disconnected from invalid user frontend 103.59.95.12 port 44778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.47
country_id: 798544
description:
Nov 19 16:30:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.228.33.47, lip=66.85.158.91, TLS, session=<hHy6evBDZoxb5CEv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.111.248
country_id: 3469034
description:
Nov 19 16:30:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.85.111.248, lip=66.85.158.91, TLS, session=<pQ/Ve/BDpN67VW/4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.2
country_id: 3017382
description:
Nov 19 16:31:01 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.2, lip=66.85.158.92, session=<GgPufvBDtcRb51kC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.106
country_id: 3017382
description:
Nov 19 16:31:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.106, lip=66.85.158.92, session=<skUgf/BDv+Nb51lq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.7
country_id: 3017382
description:
Nov 19 16:30:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.7, lip=66.85.158.92, session=</hpjffBDW9Nb51kH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:33:18 host2 sshd[338945]: Disconnected from invalid user ali 160.187.210.95 port 46232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:34:43 host2 sshd[339755]: Disconnected from invalid user admin 103.59.95.12 port 38912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:36:34 host2 sshd[341357]: Disconnected from invalid user nw 27.112.78.223 port 50436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.12
country_id: 1643084
description:
Nov 19 16:38:21 host2 sshd[342359]: Disconnected from invalid user goran 103.59.95.12 port 33558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:39:05 host2 sshd[342789]: Disconnected from invalid user milad 27.112.78.223 port 60236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-19 16:40:22 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:53892: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:40:41 host2 sshd[344079]: Disconnected from invalid user milad 160.187.210.95 port 58532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:42:06 host2 sshd[345131]: Disconnected from invalid user little 160.187.210.95 port 33744 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.223
country_id: 1643084
description:
Nov 19 16:42:47 host2 sshd[345600]: Disconnected from invalid user deploy 27.112.78.223 port 50208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:43:28 host2 sshd[346063]: Disconnected from invalid user gerrit 160.187.210.95 port 44964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:43:39 host2 sshd[346174]: Disconnected from invalid user administrator 198.98.56.205 port 51426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.187.210.95
country_id: 1880251
description:
Nov 19 16:44:54 host2 sshd[347402]: Disconnected from invalid user lc 160.187.210.95 port 37228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 19 16:45:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, TLS: Connection closed, session=<UFRos/BDmuKUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:45:59 host2 sshd[348315]: Disconnected from invalid user mp 198.98.56.205 port 57270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.57
country_id: 6251999
description:
Nov 19 16:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.57, lip=66.85.158.91, session=<1OELv/BDaqqUccE5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:52:25 host2 sshd[352297]: Disconnected from invalid user gabriele 198.98.56.205 port 35156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 19 16:55:32 host2 sshd[355050]: Disconnected from invalid user udin 198.98.56.205 port 53650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.203.86.207
country_id: 6252001
description:
2025-11-19 16:57:49 dovecot_login authenticator failed for ([74.203.86.207]) [74.203.86.207]:60789: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-11-19 16:58:03 dovecot_login authenticator failed for (92.62.243.154.fibermax.bg) [92.62.243.154]:48107: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Nov 19 17:00:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<UP+f5vBDZn4tIVDz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Nov 19 17:00:11 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, TLS, session=<4fFA5/BD3C6saAsu>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-19 17:05:21 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (favoripoon) [73.88.196.91]:60332: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 92.246.87.86
country_id: 2921044
description:
2025-11-19 17:05:40 H=([92.246.87.86]) [92.246.87.86]:53618 F=<info@roc-tech.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-19 17:08:00 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:57402: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-11-19 17:08:27 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:45648: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-19 17:08:55 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:42142: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:19:48 host2 sshd[372586]: Disconnected from invalid user ubuntu 165.154.200.14 port 33144 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 19 17:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<W4oLMvFD4uMjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:21:26 host2 sshd[373679]: Disconnected from invalid user ubuntu 43.160.251.55 port 59634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:22:49 host2 sshd[374431]: Disconnected from invalid user user01 79.106.73.114 port 40304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:24:24 host2 sshd[375271]: Disconnected from invalid user moodle 68.183.46.135 port 32886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:24:28 host2 sshd[375293]: Disconnected from invalid user dspace 159.253.36.117 port 55390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:24:32 host2 sshd[375319]: Disconnected from invalid user fengyun 43.160.251.55 port 46244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.18
country_id: 1269750
description:
Nov 19 17:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=103.207.4.18, lip=66.85.158.91, TLS, session=<U75DQfFDLJtnzwQS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.92.68.200
country_id: 732800
description:
Nov 19 17:25:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.92.68.200, lip=66.85.158.91, TLS, session=<5VaNQvFDIQhbXETI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:28:00 host2 sshd[377537]: Disconnected from invalid user eddie 79.106.73.114 port 35986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:28:26 host2 sshd[377787]: Disconnected from invalid user user 43.160.251.55 port 34160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.73.114
country_id: 783754
description:
Nov 19 17:29:13 host2 sshd[378252]: Disconnected from invalid user hydra 79.106.73.114 port 45942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:29:17 host2 sshd[378279]: Disconnected from invalid user moodle 159.253.36.117 port 43674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:28:31 host2 sshd[377818]: Disconnected from invalid user ubuntu 68.183.46.135 port 33512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:30:26 host2 sshd[379146]: Disconnected from invalid user hydra 159.253.36.117 port 41198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:30:35 host2 sshd[379334]: Disconnected from invalid user user 68.183.46.135 port 48712 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 19 17:32:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0zGFWfFDGK1ChJlx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.253.36.117
country_id: 298795
description:
Nov 19 17:31:31 host2 sshd[379870]: Disconnected from invalid user ubuntu 159.253.36.117 port 54158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.136
country_id: 1269750
description:
2025-11-19 17:31:41 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.136]:42372: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-11-19 17:32:00 dovecot_login authenticator failed for (31-154-88-51.orange.net.il) [2.55.88.51]:44289: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.85
country_id: 3469034
description:
Nov 19 17:33:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=191.53.40.85, lip=66.85.158.91, TLS, session=<OGy+W/FD8r6/NShV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.8
country_id: 3469034
description:
Nov 19 17:32:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=191.53.40.8, lip=66.85.158.91, TLS, session=<02N1WvFD59e/NSgI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 19 17:33:34 host2 sshd[380870]: Disconnected from invalid user dspace 68.183.46.135 port 43892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 17:34:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YfmAY/FDIpvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:35:09 host2 sshd[381851]: Disconnected from invalid user admin 165.154.200.14 port 59800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:37:28 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:61459: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:37:34 dovecot_login authenticator failed for ([103.17.193.137]) [103.17.193.137]:61459: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:40:07 host2 sshd[385228]: Disconnected from invalid user ubuntu 43.160.251.55 port 53484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 17:40:36 host2 sshd[385555]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:40:38 host2 sshd[385582]: Disconnected from invalid user gerrit 165.154.200.14 port 56056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-19 17:41:12 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:43096: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-19 17:41:25 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:57582: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 19 17:42:28 host2 sshd[386640]: Disconnected from invalid user hydra 165.154.200.14 port 58916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 19 17:42:47 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<VNmef/FDANUD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 17:43:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=</nLOgPFDNKzPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:46:22 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:58722: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.38.169
country_id: 953987
description:
Nov 19 17:47:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.38.169, lip=66.85.158.91, TLS, session=<1pplkPFD06RmQCap>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.117.50
country_id: 3175395
description:
Nov 19 17:48:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.238.117.50, lip=66.85.158.91, TLS, session=<3o/HkfFDVIxb7nUy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-19 17:50:14 dovecot_plain authenticator failed for (heeis) [65.20.143.159]:56164: 535 Incorrect authentication data (set_id=contato@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.251.55
country_id: 1880251
description:
Nov 19 17:51:59 host2 sshd[393594]: Disconnected from invalid user dspace 43.160.251.55 port 46708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:55:43 dovecot_plain authenticator failed for ([103.17.193.137]) [103.17.193.137]:52276: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.193.137
country_id: 1269750
description:
2025-11-19 17:58:32 dovecot_login authenticator failed for ([103.17.193.137]) [103.17.193.137]:52276: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.50
country_id: 6252001
description:
Nov 19 18:09:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.80.105.50, lip=66.85.158.91, TLS, session=<96UD3/FDBqAUUGky>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-19 18:09:48 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (aralsheod) [174.161.27.82]:33995: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-19 18:14:08 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:35336: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-19 18:13:24 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:58320: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 18:23:42 host2 sshd[416244]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 19 18:26:56 host2 sshd[418176]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 58805


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.69.10.175
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.69.10.175 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:34:16 host2 sshd[422234]: Disconnected from invalid user tuan 167.99.78.165 port 46858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.97.110
country_id: 6252001
description:
Nov 19 18:34:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.211.97.110, lip=66.85.158.91, session=<iRfkOPJDapLG02Fu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 18:35:08 host2 sshd[422848]: Disconnected from invalid user sshtunnel 45.78.202.58 port 47970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:35:49 host2 sshd[423139]: Disconnected from invalid user rundeck 118.139.164.171 port 42954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.97.110
country_id: 6252001
description:
Nov 19 18:35:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.211.97.110, lip=66.85.158.92, session=<7RRiPfJDdt/G02Fu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:37:08 host2 sshd[423983]: Disconnected from invalid user deploy 51.83.71.110 port 59316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:37:15 host2 sshd[424031]: Disconnected from invalid user hundsun 27.111.32.174 port 37988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.197
country_id: 3175395
description:
Nov 19 18:36:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.171.197, lip=66.85.158.91, TLS, session=<iBk9PvJDR6u5D6vF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.124.79.130
country_id: 732800
description:
Nov 19 18:36:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=188.124.79.130, lip=66.85.158.91, TLS, session=<OrhYP/JDw9y8fE+C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Nov 19 18:37:16 host2 sshd[424041]: Disconnected from invalid user mario 202.70.65.229 port 42020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.80
country_id: 3469034
description:
Nov 19 18:37:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=191.53.131.80, lip=66.85.158.91, TLS, session=<vynaQ/JD3qS/NYNQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-19 18:38:01 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (throte) [87.103.126.54]:51785: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:38:59 host2 sshd[424830]: Disconnected from invalid user admin 118.139.164.171 port 35140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.236
country_id: 3469034
description:
Nov 19 18:38:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.199.236, lip=66.85.158.91, TLS, session=<zNoiRfJD0Mmzvcfs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:40:33 host2 sshd[425771]: Disconnected from invalid user ubuntu 118.139.164.171 port 49096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:41:39 host2 sshd[426182]: Disconnected from invalid user eddie 103.127.242.211 port 48526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:41:54 host2 sshd[426374]: Disconnected from invalid user sagar 167.99.78.165 port 57102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.225.226.106
country_id: 690791
description:
Nov 19 18:43:07 host2 sshd[426955]: Disconnected from invalid user deploy 185.225.226.106 port 37012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:43:16 host2 sshd[427040]: Disconnected from invalid user max 167.99.78.165 port 54008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:42:32 host2 sshd[426696]: Disconnected from invalid user gl 51.83.71.110 port 39242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:43:28 host2 sshd[427137]: Disconnected from invalid user rundeck 165.227.3.79 port 42553 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:43:47 host2 sshd[427249]: Disconnected from invalid user sftpuser 51.83.71.110 port 40984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:44:52 host2 sshd[428052]: Disconnected from invalid user payara 165.227.3.79 port 57737 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:45:04 host2 sshd[428265]: Disconnected from invalid user jumpserver 51.83.71.110 port 43764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Nov 19 18:46:03 host2 sshd[429123]: Disconnected from invalid user koha 167.99.78.165 port 53578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.139.164.171
country_id: 1880251
description:
Nov 19 18:46:26 host2 sshd[429392]: Disconnected from invalid user validation 118.139.164.171 port 53854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.67
country_id: 3865483
description:
Nov 19 18:46:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=181.225.195.67, lip=66.85.158.91, TLS, session=<hRPbYvJDN8y14cND>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.154
country_id: 3175395
description:
Nov 19 18:46:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=217.26.179.154, lip=66.85.158.91, TLS, session=<qWj9Y/JDScbZGrOa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.110
country_id: 3017382
description:
Nov 19 18:46:20 host2 sshd[429357]: Disconnected from invalid user ubuntu 51.83.71.110 port 37992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:47:30 host2 sshd[430000]: Disconnected from invalid user simon 27.111.32.174 port 37078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 19 18:47:42 host2 sshd[430113]: Disconnected from invalid user habib 165.227.3.79 port 59889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:48:20 host2 sshd[430566]: Disconnected from invalid user julian 103.127.242.211 port 36806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 19 18:48:25 host2 sshd[430645]: Disconnected from invalid user test3 51.91.98.128 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 18:49:28 host2 sshd[431027]: Disconnected from invalid user tuan 45.78.205.93 port 50938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.127.242.211
country_id: 1861060
description:
Nov 19 18:49:44 host2 sshd[431591]: Disconnected from invalid user morteza 103.127.242.211 port 60868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.225.226.106
country_id: 690791
description:
Nov 19 18:49:56 host2 sshd[431691]: Disconnected from invalid user webuser 185.225.226.106 port 39688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.128
country_id: 3017382
description:
Nov 19 18:50:29 host2 sshd[432374]: Disconnected from invalid user webuser 51.91.98.128 port 40590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 19 18:51:59 host2 sshd[433101]: Disconnected from invalid user test3 27.111.32.174 port 54334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 18:53:59 host2 sshd[434289]: Disconnected from invalid user aryan 45.78.205.93 port 44490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-19 18:57:56 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:41752: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-19 18:58:52 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:45848: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-19 18:58:23 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:49674: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 19:01:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54082: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 19:01:53 host2 sshd[439768]: Disconnected from invalid user jumpserver 45.78.202.58 port 37566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 19 19:03:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 7 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<LnuInvJDYiRChJlx>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-19 19:14:05 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:58944: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-11-19 19:13:43 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:40467: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.252
country_id: 3865483
description:
Nov 19 19:16:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.177.200.252, lip=66.85.158.91, TLS, session=<tfs7z/JDRqQtscj8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.128.35
country_id: 732800
description:
Nov 19 19:16:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=77.76.128.35, lip=66.85.158.91, TLS, session=<nRg4zfJDct9NTIAj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.117.35.32
country_id: 798544
description:
Nov 19 19:16:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=195.117.35.32, lip=66.85.158.91, TLS, session=<YGxJzvJDpgrDdSMg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.212.202
country_id: 99237
description:
Nov 19 19:17:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.212.202, lip=66.85.158.91, TLS, session=<aoRs0PJD+J9BFNTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 19:20:52 host2 sshd[456197]: Disconnected from invalid user debian 45.78.205.93 port 52818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.58
country_id: 1880251
description:
Nov 19 19:21:50 host2 sshd[456710]: Disconnected from invalid user sftpuser 45.78.202.58 port 52588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.93
country_id: 1880251
description:
Nov 19 19:25:48 host2 sshd[459808]: Disconnected from invalid user koha 45.78.205.93 port 40736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 19 19:31:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<eGDkBPNDDNcjygmF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 19 19:32:24 host2 pure-ftpd[464034]: (?@66.132.153.118) [INFO] New connection from 66.132.153.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 19 19:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS: Connection closed, session=<Y7NPP/ND1qQz3piW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 19:48:17 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.214
country_id: 1269750
description:
Nov 19 19:51:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.30.83.214, lip=66.85.158.91, TLS, session=<ym33SfNDUt1nHlPW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.71
country_id: 3175395
description:
Nov 19 19:51:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.8.71, lip=66.85.158.91, TLS, session=<j/1dS/NDSpS5xQhH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 19:52:46 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.125.229
country_id: 6252001
description:
Nov 19 20:01:12 host2 pure-ftpd[486686]: (?@134.122.125.229) [INFO] New connection from 134.122.125.229


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6khAg/ND39ii2JVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:07:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<kb5BhPNDTO2i2JVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.106
country_id: 6252001
description:
Nov 19 20:12:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.106, lip=66.85.158.91, TLS, session=<SxWOlfNDKuui2JVq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 20:20:43 host2 sshd[500605]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.236
country_id: 6252001
description:
Nov 19 20:22:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.236, lip=66.85.158.92, session=<uuZYuvND1b5APsXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Nov 19 20:22:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS: Connection closed, session=<coIeu/NDZNJAPsXj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.56
country_id: 6252001
description:
Nov 19 20:22:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.56, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gTkXu/NDKXpAPsU4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Nov 19 20:22:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<T+EpvPND+INAPsUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:29:36 host2 sshd[506864]: Disconnected from invalid user staging 203.129.217.73 port 59076 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:31:03 host2 sshd[507807]: Disconnected from invalid user admin 203.129.217.73 port 49608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.129.217.73
country_id: 1269750
description:
Nov 19 20:32:25 host2 sshd[508487]: Disconnected from invalid user amir 203.129.217.73 port 53204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.147
country_id: 953987
description:
Nov 19 20:33:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.41.147, lip=66.85.158.91, TLS, session=<Zo0s4vND+6dmQCmT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 20:33:22 host2 pure-ftpd[509108]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.170
country_id: 3175395
description:
Nov 19 20:33:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=178.239.35.170, lip=66.85.158.91, TLS, session=<KFwD4fNDo7Ky7yOq>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 20:33:36 host2 pure-ftpd[509367]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.139
country_id: 798544
description:
Nov 19 20:35:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.216.31.139, lip=66.85.158.91, TLS, session=<zODh5vNDnrmy2B+L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.228
country_id: 953987
description:
Nov 19 20:35:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=102.64.47.228, lip=66.85.158.91, TLS, session=<+A8J6PNDubBmQC/k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:41:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H0Cr//NDos6TuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:42:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4xDJAvRD1PuTuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:43:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<4VCzBPRDzPWTuYUw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 20:46:12 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:49:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS, session=<4UzTG/RDYOqTuYUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.48
country_id: 6252001
description:
Nov 19 20:50:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.48, lip=66.85.158.92, TLS, session=<wTdPHvRDbviTuYUw>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:01:25 host2 sshd[528664]: Disconnected from invalid user aaa 190.167.75.90 port 58052 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 21:01:46 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.96
country_id: 953987
description:
Nov 19 21:03:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=102.129.53.96, lip=66.85.158.91, TLS, session=<5ZTWSvRD3bNmgTVg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-19 21:04:07 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.101
country_id: 690791
description:
Nov 19 21:03:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.101, lip=66.85.158.91, TLS, session=<I+0FTPRDTZLCLIxl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:09:08 host2 sshd[535299]: Disconnected from invalid user test3 190.167.75.90 port 38186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:12:19 host2 sshd[537964]: Disconnected from invalid user socksuser 190.167.75.90 port 54352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:15:17 host2 sshd[540440]: Disconnected from invalid user en 190.167.75.90 port 42288 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 21:21:21 host2 sshd[544509]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:21:18 host2 sshd[545068]: Disconnected from invalid user es 174.84.246.11 port 46258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:23:55 host2 sshd[546614]: Disconnected from invalid user marco 174.84.246.11 port 47514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.248
country_id: 3469034
description:
Nov 19 21:23:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.8.251.248, lip=66.85.158.91, TLS, session=<wl6ClfRD1+SxCPv4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.198
country_id: 3865483
description:
Nov 19 21:25:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.101.198, lip=66.85.158.91, TLS, session=<xohnmfRDLdy+tWXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.67
country_id: 3469034
description:
Nov 19 21:24:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=138.36.202.67, lip=66.85.158.91, TLS, session=<Iy3LlvRDrLiKJMpD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 19 21:24:51 host2 sshd[547102]: Disconnected from invalid user ftp_user 190.167.75.90 port 34337 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.13
country_id: 933860
description:
Nov 19 21:25:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 31 secs): user=<info>, method=PLAIN, rip=41.216.213.13, lip=66.85.158.91, TLS, session=<Q6G1mvRDnt4p2NUN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:26:26 host2 sshd[548247]: Disconnected from invalid user ubuntu 174.84.246.11 port 48758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:26:47 host2 sshd[548386]: Disconnected from invalid user es 216.158.226.77 port 43102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:31:30 host2 sshd[550891]: Disconnected from invalid user ubuntu 174.84.246.11 port 51236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:33:17 host2 sshd[551805]: Disconnected from invalid user systemd 216.158.226.77 port 47882 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:35:45 host2 sshd[554720]: Disconnected from invalid user odoo17 216.158.226.77 port 34950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.84.246.11
country_id: 6252001
description:
Nov 19 21:36:46 host2 sshd[555448]: Disconnected from invalid user marko 174.84.246.11 port 53738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:36:58 host2 sshd[555735]: Disconnected from invalid user paolo 216.158.226.77 port 59034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.212
country_id: 953987
description:
Nov 19 21:38:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.62.212, lip=66.85.158.91, TLS, session=<92i4x/RDd4BmgT7U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.151
country_id: 3469034
description:
Nov 19 21:37:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.209.247.151, lip=66.85.158.91, TLS, session=<4wlTxvRDBd260feX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.158.226.77
country_id: 6252001
description:
Nov 19 21:38:10 host2 sshd[560320]: Disconnected from invalid user snort 216.158.226.77 port 49094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-19 21:38:31 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:42964: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 19 21:39:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r1f1zvRDtKBChJmN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.160.125.236
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 217.160.125.236 - v-deploycom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user v-deploycom (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:50:45 host2 sshd[584004]: Disconnected from invalid user student2 151.46.175.94 port 21559 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:51:36 host2 sshd[585020]: Disconnected from invalid user ftp_id 151.43.127.92 port 59806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:53:47 host2 sshd[598649]: Disconnected from invalid user school 151.43.127.92 port 59550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:56:42 host2 sshd[602002]: Disconnected from invalid user hadoop 151.46.175.94 port 21207 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 21:57:59 host2 sshd[602965]: Disconnected from invalid user developer 151.46.175.94 port 21471 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 21:59:07 host2 sshd[603752]: Disconnected from invalid user red 154.9.249.104 port 44396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 21:59:44 host2 sshd[604126]: Disconnected from invalid user hossein 151.43.127.92 port 59580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:01:18 host2 sshd[605376]: Disconnected from invalid user hussein 40.115.18.231 port 39132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:03:23 host2 sshd[607617]: Disconnected from invalid user admin 102.204.206.49 port 54922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:02:38 host2 sshd[606373]: Disconnected from invalid user admin 40.115.18.231 port 41928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Nov 19 22:03:53 host2 sshd[608073]: Disconnected from invalid user admin 40.115.18.231 port 44702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 22:04:52 host2 sshd[608734]: Disconnected from invalid user gf 154.9.249.104 port 52198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.92
country_id: 3175395
description:
Nov 19 22:05:37 host2 sshd[609430]: Disconnected from invalid user jorge 151.43.127.92 port 59474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.9.249.104
country_id: 6252001
description:
Nov 19 22:05:55 host2 sshd[609644]: Disconnected from invalid user roman 154.9.249.104 port 50900 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 22:06:47 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<2hPBL/VDRLXPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 19 22:06:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<6cvRL/VDYLXPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:09:34 host2 sshd[612708]: Disconnected from invalid user init 150.5.169.138 port 52270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.12
country_id: 6252001
description:
Nov 19 22:09:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.12, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7XtAOvVDE69BMQEM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.10
country_id: 6252001
description:
Nov 19 22:10:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.10, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dn5RO/VDGiFBMQEK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:10:42 host2 sshd[613770]: Disconnected from invalid user server 102.204.206.49 port 55348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.74
country_id: 3017382
description:
Nov 19 22:11:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.74, lip=66.85.158.91, session=<yxpMP/VDCaFbxJhK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 19 22:11:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, session=<P6f/P/VDOdpbxJhN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:12:16 host2 sshd[614900]: Disconnected from invalid user mike 150.5.169.138 port 45442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov 19 22:11:35 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.77, lip=66.85.158.91, session=<1HLmQPVDQ8hbxJhN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.175.94
country_id: 3175395
description:
Nov 19 22:12:48 host2 sshd[615355]: Disconnected from invalid user tata 151.46.175.94 port 21990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:14:09 host2 sshd[616377]: Disconnected from invalid user maksym 51.68.141.174 port 34676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:14:11 host2 sshd[616400]: Disconnected from invalid user knu 50.28.107.101 port 40086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:15:54 host2 sshd[617729]: Disconnected from invalid user cc 51.68.141.174 port 36246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:17:03 host2 sshd[618442]: Disconnected from invalid user atl 51.68.141.174 port 42514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Nov 19 22:17:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.231, lip=66.85.158.91, session=<uAOlVPVDBZlb5qjn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.100
country_id: 6252001
description:
Nov 19 22:17:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.100, lip=66.85.158.91, session=<1vwRVvVDU6Rb5qhk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.98
country_id: 6252001
description:
Nov 19 22:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.98, lip=66.85.158.91, session=<sPFAVvVDI+Vb5qhi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:17:37 host2 sshd[618972]: Disconnected from invalid user server 150.5.169.138 port 54312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:18:30 host2 sshd[619574]: Disconnected from invalid user mike 102.204.206.49 port 43796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:19:17 host2 sshd[620146]: Disconnected from invalid user ubuntu 50.28.107.101 port 57578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:20:26 host2 sshd[621032]: Disconnected from invalid user max 140.238.15.104 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.204.206.49
country_id: 2464461
description:
Nov 19 22:19:49 host2 sshd[620412]: Disconnected from invalid user git 102.204.206.49 port 51086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Nov 19 22:20:11 host2 sshd[620795]: Disconnected from invalid user ansible 150.5.169.138 port 60270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-19 22:21:17 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:52170: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 19 22:21:27 host2 sshd[621651]: Disconnected from invalid user suman 51.68.141.174 port 40316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-19 22:21:30 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:28664: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.28.107.101
country_id: 6252001
description:
Nov 19 22:21:53 host2 sshd[621918]: Disconnected from invalid user test 50.28.107.101 port 35460 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.227.226.218
country_id: 6252001
description:
Nov 19 22:25:27 host2 pure-ftpd[624286]: (?@54.227.226.218) [INFO] New connection from 54.227.226.218


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:29:02 host2 sshd[626102]: Disconnected from invalid user mike 140.238.15.104 port 44796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Nov 19 22:32:08 host2 sshd[628009]: Disconnected from invalid user user2 103.26.136.173 port 48616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 19 22:33:13 host2 sshd[628452]: Disconnected from invalid user pvx 107.189.29.175 port 34816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 19 22:35:34 host2 sshd[629526]: Disconnected from invalid user juan 107.189.29.175 port 59370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Nov 19 22:36:51 host2 sshd[629987]: Disconnected from invalid user ts3 103.26.136.173 port 59408 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 19 22:38:57 host2 pure-ftpd[630860]: (?@198.235.24.171) [INFO] New connection from 198.235.24.171


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 22:45:20 host2 sshd[634162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 19 22:45:43 host2 sshd[634384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.186
country_id: 3469034
description:
Nov 19 22:46:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=186.209.246.186, lip=66.85.158.91, TLS, session=<NOi6u/VDJpW60fa6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-19 22:46:16 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:47482: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.55
country_id: 3469034
description:
Nov 19 22:45:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.39.32.55, lip=66.85.158.91, TLS, session=</iltuvVDFruxJyA3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-19 22:46:38 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:60106: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-19 22:51:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.155.93
country_id: 99237
description:
Nov 19 22:53:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.155.93, lip=66.85.158.91, TLS, session=<ayfA1fVDteBBFJtd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.230.7
country_id: 798544
description:
Nov 19 22:53:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=193.43.230.7, lip=66.85.158.91, TLS, session=<OYOp1PVDyJjBK+YH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-19 22:57:59 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:44664: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-19 22:58:10 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:54666: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.15.104
country_id: 1835841
description:
Nov 19 22:58:52 host2 sshd[641359]: Disconnected from invalid user username 140.238.15.104 port 52906 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.55.41.75
country_id: 357994
description:
[2025-11-19 23:07:06 +0530] info [cpaneld] 197.55.41.75 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.139
country_id: 1269750
description:
Nov 19 23:07:09 host2 sshd[647292]: Disconnected from invalid user juan 205.254.166.139 port 46268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-11-19 23:13:47 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:50526: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-19 23:14:27 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:49002: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.139
country_id: 1269750
description:
Nov 19 23:18:08 host2 sshd[654001]: Disconnected from invalid user bender 205.254.166.139 port 1841 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 19 23:17:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, session=<Kjm0LfZDzj+4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov 19 23:18:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ymLOLvZDkJ9APpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov 19 23:18:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS: Connection closed, session=<ErjEMPZDEiVAPpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.42
country_id: 1880251
description:
Nov 19 23:20:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=139.99.35.42, lip=66.85.158.91, session=<eXLUN/ZDvYGLYyMq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.45
country_id: 1880251
description:
Nov 19 23:21:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 22 secs): user=<>, rip=139.99.35.45, lip=66.85.158.91, session=<LwEvOfZDO4WLYyMt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.161.85
country_id: 3469034
description:
Nov 19 23:23:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.44.161.85, lip=66.85.158.91, TLS, session=<7gqmQfZDGpOxLKFV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.178
country_id: 3175395
description:
Nov 19 23:23:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.178, lip=66.85.158.91, TLS, session=<1UfOQvZD9MO5xQmy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.163
country_id: 2635167
description:
Nov 19 23:29:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r4+xVvZDvY2594mj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.78
country_id: 2635167
description:
Nov 19 23:29:14 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.78, lip=66.85.158.91, TLS, session=<Q/2fVvZDwbtX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.176
country_id: 2635167
description:
Nov 19 23:29:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nAGtWPZDf4VX7LCw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Nov 19 23:30:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pWaoWvZDY6a594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.180
country_id: 2635167
description:
Nov 19 23:31:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.180, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<eh2fXvZDBZRX7LC0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.163
country_id: 2635167
description:
Nov 19 23:30:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.163, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<4qujXPZDmexX7LCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.152
country_id: 2635167
description:
Nov 19 23:32:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<132YYPZDk9G594mY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 19 23:33:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<0+2UZPZDw6K594mf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.173
country_id: 2635167
description:
Nov 19 23:32:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MoCZYvZDkeO594mt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.175
country_id: 2635167
description:
Nov 19 23:34:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.175, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<36SJaPZDOYC594mv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Nov 19 23:33:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<8DyOZvZDFapX7LCf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-11-19 23:35:38 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:51748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-19 23:35:57 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:37268: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.91.107.7
country_id: 6252001
description:
Nov 19 23:37:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.91.107.7, lip=66.85.158.91, session=<Q1XudfZD2JuKW2sH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.96.197
country_id: 6252001
description:
Nov 19 23:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.233.96.197, lip=66.85.158.92, session=<qCiye/ZDVKeH6WDF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-19 23:50:44 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:61782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-19 23:50:53 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58510: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:53:38 host2 sshd[677593]: Disconnected from invalid user postgres 98.159.109.235 port 34864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 19 23:54:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<Dx32sPZDUD+s7ORz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Nov 19 23:54:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.92, session=<p4H5sPZDOvotIVDz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:56:14 host2 sshd[679890]: Disconnected from invalid user admin 98.159.109.235 port 48864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-19 23:57:03 dovecot_login authenticator failed for ([128.185.224.109]) [125.20.253.86]:57156: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-19 23:56:48 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:38854: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Nov 19 23:57:38 host2 sshd[680829]: Disconnected from invalid user prod 98.159.109.235 port 58256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.125.141.16
country_id: 2750405
description:
Nov 20 00:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=625) failed: Connection reset by peer (no auth attempts in 38 secs): user=<>, rip=52.125.141.16, lip=66.85.158.91, TLS: read(size=625) failed: Connection reset by peer, session=</km93fZDxA40fY0Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.92
country_id: 3469034
description:
Nov 20 00:07:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=200.196.143.92, lip=66.85.158.91, TLS, session=<98ZV3fZDc+TIxI9c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.125.141.22
country_id: 2750405
description:
Nov 20 00:07:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=625) failed: Connection reset by peer (no auth attempts in 42 secs): user=<>, rip=52.125.141.22, lip=66.85.158.91, TLS: read(size=625) failed: Connection reset by peer, session=</4nA3vZDzy00fY0W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.23.198
country_id: 798544
description:
Nov 20 00:07:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=80.82.23.198, lip=66.85.158.91, TLS, session=<kEmX3vZDlqhQUhfG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.210
country_id: 6252001
description:
Nov 20 00:11:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rxr47PZDacOTuYTS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-20 00:18:58 dovecot_plain authenticator failed for (folum) [76.190.155.43]:41064: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:20:41 host2 sshd[697687]: Disconnected from invalid user user 103.226.139.104 port 57156 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@seyawin.com [11/19/2025:18:51:28 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@seyawin.com


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.25.42
country_id: 6252001
description:
Nov 20 00:21:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.25.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RWYSEfdDxsYUqxkq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:23:15 host2 sshd[699057]: Disconnected from invalid user omer 103.226.139.104 port 40790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov 20 00:24:06 host2 pure-ftpd[699548]: (?@147.185.132.234) [INFO] New connection from 147.185.132.234


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:24:40 host2 sshd[699864]: Disconnected from invalid user oracle 103.226.139.104 port 36110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.104
country_id: 1643084
description:
Nov 20 00:30:10 host2 sshd[703027]: Disconnected from invalid user devops 103.226.139.104 port 49710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 20 00:32:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<yUp+OfdDzg6nXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-20 00:40:47 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:37336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 00:41:53 host2 sshd[709062]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-20 00:41:08 dovecot_login authenticator failed for ([201.172.88.85]) [201.172.88.85]:60801: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 00:42:15 host2 sshd[709280]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.50.254.252
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.50.254.252 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 00:46:57 host2 sshd[712401]: Disconnected from invalid user user 2.57.121.25 port 34165 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.195
country_id: 6252001
description:
Nov 20 00:47:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sAF4bfdD4sQUQGjD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.214.9
country_id: 933860
description:
Nov 20 00:49:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=41.216.214.9, lip=66.85.158.91, TLS, session=<qspYc/dD1p4p2NYJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.247
country_id: 3469034
description:
Nov 20 00:49:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.128.247, lip=66.85.158.91, TLS, session=<6tymdPdDMpm/NYD3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.143
country_id: 3469034
description:
Nov 20 00:49:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=177.44.71.143, lip=66.85.158.91, TLS, session=<d2+WdPdDA9KxLEeP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.18
country_id: 798544
description:
Nov 20 00:49:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.219.102.18, lip=66.85.158.91, TLS, session=<p5thc/dDP92y22YS>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - info@seyawin.com [11/19/2025:19:25:41 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: info@seyawin.com


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Nov 20 01:03:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.207.181, lip=66.85.158.91, session=<DmD/pfdDJOItT8+1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.81.178.241
country_id: 3057568
description:
Nov 20 01:15:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=213.81.178.241, lip=66.85.158.91, TLS, session=<cJho0PdDMw3VUbLx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.255
country_id: 3057568
description:
Nov 20 01:15:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.226.113.255, lip=66.85.158.91, TLS, session=<OjeH0fdDHatb4nH/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-20 01:19:59 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:47086: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-20 01:20:14 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:44828: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-20 01:38:17 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:55737: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-20 01:38:30 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:47658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-20 01:39:43 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (pught) [98.40.101.10]:52222: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-20 01:48:44 dovecot_plain authenticator failed for (taner) [76.190.155.43]:43600: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.22
country_id: 3469034
description:
Nov 20 01:52:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.240.37.22, lip=66.85.158.91, TLS, session=<sPXTVvhDf8K/8CUW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.37
country_id: 953987
description:
Nov 20 01:53:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=102.64.37.37, lip=66.85.158.91, TLS, session=<iPAPWPhD5LlmQCUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:54:06 host2 sshd[761552]: Disconnected from invalid user esbuser 196.189.116.182 port 58466 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 01:55:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.212, lip=66.85.158.91, session=<hV7gYPhDMsiUcdbU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:58:08 host2 sshd[764635]: Disconnected from invalid user hacker 196.189.116.182 port 55552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:59:32 host2 sshd[765421]: Disconnected from invalid user runner 196.189.116.182 port 37536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 20 02:02:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HxdbefhD8vRChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.85.20
country_id: 3865483
description:
Nov 20 02:04:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.181.85.20, lip=66.85.158.91, TLS, session=<DE7hf/hDHra+tVUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.193
country_id: 690791
description:
Nov 20 02:04:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=176.103.25.193, lip=66.85.158.91, TLS, session=<bAcmgfhDEc2wZxnB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.36.38
country_id: 99237
description:
[2025-11-20 02:08:41 +0530] info [whostmgrd] 169.224.36.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:16:39 host2 sshd[776444]: Disconnected from invalid user ubuntu 187.110.238.50 port 50852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:17:54 host2 sshd[777150]: Disconnected from invalid user masud 45.78.227.155 port 57564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:17:18 host2 sshd[776791]: Disconnected from invalid user student10 107.150.106.178 port 57502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:19:06 host2 sshd[777802]: Disconnected from invalid user danil 107.150.106.178 port 53136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:20:52 host2 sshd[778955]: Disconnected from invalid user pivpn 51.83.129.117 port 46694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:21:32 host2 sshd[779313]: Disconnected from invalid user rich 198.46.207.98 port 46670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:21:40 host2 sshd[779356]: Disconnected from invalid user syncthing 187.110.238.50 port 50080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:22:23 host2 sshd[779698]: Disconnected from invalid user ica 41.33.91.226 port 58744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:23:05 host2 sshd[780043]: Disconnected from invalid user last 51.83.129.117 port 47864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:23:11 host2 sshd[780079]: Disconnected from invalid user newftpuser 187.110.238.50 port 52684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:23:43 host2 sshd[780349]: Disconnected from invalid user mostafa 41.33.91.226 port 39806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:24:44 host2 sshd[781089]: Disconnected from invalid user kate 187.110.238.50 port 55286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:24:14 host2 sshd[780810]: Disconnected from invalid user wanghao 51.83.129.117 port 48440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:24:21 host2 sshd[780883]: Disconnected from invalid user qendrimellupo 103.117.56.152 port 41176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:25:20 host2 sshd[781527]: Disconnected from invalid user git 51.83.129.117 port 49014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:26:22 host2 sshd[782208]: Disconnected from invalid user sachi 187.110.238.50 port 57890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:27:41 host2 sshd[782828]: Disconnected from invalid user devops 103.193.178.248 port 38540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:27:09 host2 sshd[782573]: Disconnected from invalid user mostafa 198.46.207.98 port 34614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:27:21 host2 sshd[782662]: Disconnected from invalid user mark 41.33.91.226 port 45520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:28:14 host2 sshd[783140]: Disconnected from invalid user testuser 198.46.207.98 port 41928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:29:13 host2 sshd[783688]: Disconnected from invalid user helpdesk 103.193.178.248 port 56354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:30:55 host2 sshd[784772]: Disconnected from invalid user temp 103.117.56.152 port 57792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:33:06 host2 sshd[785919]: Disconnected from invalid user roman 103.193.178.248 port 53668 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 02:36:22 host2 sshd[788023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:39:44 host2 sshd[789433]: Disconnected from invalid user sachi 45.78.227.155 port 44094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 02:41:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63641: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-20 02:41:51 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:51612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-20 02:41:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50426: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 02:41:40 host2 sshd[791673]: Disconnected from invalid user ali 62.60.131.157 port 60033 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:40 host2 pure-ftpd[792337]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:47 host2 pure-ftpd[792405]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.65
country_id: 2510769
description:
Nov 20 02:43:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=139.28.190.65, lip=66.85.158.91, TLS, session=<62tYDflDbuCLHL5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.124
country_id: 298795
description:
Nov 20 02:44:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=45.67.155.124, lip=66.85.158.91, TLS, session=<mg54DvlD3LAtQ5t8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:44:09 host2 sshd[793054]: Disconnected from invalid user ben 62.219.172.50 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:46:27 host2 sshd[794668]: Disconnected from invalid user gpu 62.219.172.50 port 35590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:47:26 host2 sshd[795534]: Disconnected from invalid user system 103.117.56.152 port 33924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:47:34 host2 sshd[795642]: Disconnected from invalid user victor 62.219.172.50 port 51794 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.164.177.29
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.164.177.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.146.155.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.146.155.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.56.153.139
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 93.56.153.139 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.164.100.80
country_id: 2658434
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 31.164.100.80 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-20 02:49:12 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51746: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.49.162
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.49.162 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.91.124.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.91.124.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-11-20 02:49:48 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:51670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:50:30 host2 sshd[797399]: Disconnected from invalid user fad 103.117.56.152 port 35454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:50:33 host2 sshd[797441]: Disconnected from invalid user ir 179.32.207.251 port 48730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:51:50 host2 sshd[798217]: Disconnected from invalid user frappe 179.32.207.251 port 51984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:52:11 host2 sshd[798380]: Disconnected from invalid user steamcmd 62.219.172.50 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:53:08 host2 sshd[799011]: Disconnected from invalid user steamcmd 179.32.207.251 port 55216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:54:15 host2 sshd[799348]: Disconnected from invalid user ubuntu 45.78.227.155 port 37074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.233.185.13
country_id: 798544
description:
Nov 20 03:00:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.233.185.13, lip=66.85.158.91, TLS, session=<NxhVSPlDtspb6bkN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.111
country_id: 3469034
description:
Nov 20 03:00:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.243.111, lip=66.85.158.91, TLS, session=<72Z2SflD8Ny60fNv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 03:05:07 host2 sshd[807159]: Disconnected from invalid user user 2.57.121.25 port 51592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 20 03:06:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<yHY5X/lDkKCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:11:35 host2 sshd[810909]: Disconnected from invalid user himanshu 206.217.136.36 port 57842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Nov 20 03:11:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.91, session=<C0w4cvlDmPjN0h/J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:11:44 host2 sshd[810970]: Disconnected from invalid user pivpn 41.82.208.178 port 28263 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:11:46 host2 sshd[810985]: Disconnected from invalid user ahmed 45.79.189.171 port 59158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:12:54 host2 sshd[811567]: Disconnected from invalid user nodeuser 45.79.189.171 port 53558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.201
country_id: 3175395
description:
Nov 20 03:14:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=171.22.235.201, lip=66.85.158.91, TLS, session=<dwfPeflDesqrFuvJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.86.60
country_id: 3469034
description:
Nov 20 03:14:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=131.196.86.60, lip=66.85.158.91, TLS, session=<ncz1evlD9oiDxFY8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:15:07 host2 sshd[812771]: Disconnected from invalid user trading 45.79.189.171 port 39990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:15:19 host2 sshd[812921]: Disconnected from invalid user yyy 41.82.208.178 port 1565 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:17:03 host2 sshd[813744]: Disconnected from invalid user andrey 206.217.136.36 port 48258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:17:14 host2 sshd[813813]: Disconnected from invalid user ubuntu 45.79.189.171 port 53472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:17:38 host2 sshd[813975]: Disconnected from invalid user admin 161.10.72.136 port 47672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:23:31 host2 sshd[816560]: Disconnected from invalid user ubuntu 161.10.72.136 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:24:57 host2 sshd[817215]: Disconnected from invalid user git 161.10.72.136 port 59834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-20 03:25:29 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:60435: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.116
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819321]: (?@195.184.76.116) [INFO] New connection from 195.184.76.116


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.118
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819323]: (?@195.184.76.118) [INFO] New connection from 195.184.76.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-20 03:46:54 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:60530: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-20 03:47:11 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:38956: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.99.35
country_id: 1269750
description:
Nov 20 03:50:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.107.99.35, lip=66.85.158.91, TLS, session=<znBS+vlDj95na2Mj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.4
country_id: 1269750
description:
Nov 20 03:50:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.51.223.4, lip=66.85.158.91, TLS, session=<rYik+/lDEp1nM98E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.97.152
country_id: 3469034
description:
Nov 20 03:51:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.97.152, lip=66.85.158.91, TLS, session=<sXQkAPpDpoixLGGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.194
country_id: 1269750
description:
Nov 20 03:52:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.51.223.194, lip=66.85.158.91, TLS, session=<yu5cAfpDfe1nM9/C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:56:14 host2 sshd[837431]: Disconnected from invalid user admin 152.32.191.75 port 54468 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:43 host2 pure-ftpd[837933]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:34 host2 pure-ftpd[837805]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:57:29 host2 sshd[838895]: Disconnected from invalid user developer 152.32.191.75 port 38708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:58:47 host2 sshd[840202]: Disconnected from invalid user marian 152.32.191.75 port 46460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 03:59:21 host2 sshd[840594]: Disconnected from invalid user sammy 198.98.57.141 port 44986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:59:59 host2 sshd[840997]: Disconnected from invalid user support 152.32.191.75 port 47736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:00:33 host2 sshd[841684]: Disconnected from invalid user marian 198.98.57.141 port 44120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.178.110.228
country_id: 732800
description:
[2025-11-20 04:02:09 +0530] info [cpaneld] 195.178.110.228 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:01:40 host2 sshd[842396]: Disconnected from invalid user admin 198.98.57.141 port 43256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:02:53 host2 sshd[843263]: Disconnected from invalid user mustafa 119.92.70.82 port 38358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.6.218.173
country_id: 3595528
description:
2025-11-20 04:05:43 dovecot_login authenticator failed for 173.218.6.200.static.intelnet.net.gt [200.6.218.173]:38045: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.131.165.45
country_id: 2661886
description:
2025-11-20 04:05:55 dovecot_login authenticator failed for ([88.131.165.45]) [88.131.165.45]:57084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov 20 04:05:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.91, session=<fvE7NPpD+oCUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:07:04 host2 sshd[848402]: Disconnected from invalid user dima 158.69.194.34 port 55670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:06:41 host2 sshd[847859]: Disconnected from invalid user admin 119.92.70.82 port 38436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:06:54 host2 sshd[848146]: Disconnected from invalid user support 134.209.225.104 port 59448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:06:57 host2 sshd[848211]: Disconnected from invalid user mustafa 203.161.184.246 port 15707 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:08:08 host2 sshd[849547]: Disconnected from invalid user support 158.69.194.34 port 50402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:08:15 host2 sshd[849697]: Disconnected from invalid user smith 101.36.108.134 port 56532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:07:19 host2 sshd[848618]: Disconnected from invalid user mt 103.244.91.128 port 52790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:07:48 host2 sshd[849114]: Disconnected from invalid user dima 139.59.66.39 port 45628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:08:57 host2 sshd[850627]: Disconnected from invalid user grace 77.192.248.233 port 59995 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:09:07 host2 sshd[850859]: Disconnected from invalid user stack 139.59.66.39 port 34708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:10:11 host2 sshd[852244]: Disconnected from invalid user guest 101.36.108.134 port 50716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:10:13 host2 sshd[852291]: Disconnected from invalid user scanner 134.209.225.104 port 43974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:11:03 host2 sshd[853616]: Disconnected from invalid user tobias 119.92.70.82 port 46150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:10:24 host2 sshd[852569]: Disconnected from invalid user sysadmin 139.59.66.39 port 54750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:12:27 host2 sshd[855144]: Disconnected from invalid user reboot 158.69.194.34 port 44458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:13:07 host2 sshd[855690]: Disconnected from invalid user admin 205.185.125.150 port 51190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:12:40 host2 sshd[855242]: Disconnected from invalid user runner 119.92.70.82 port 48716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:12:54 host2 sshd[855401]: Disconnected from invalid user ubuntu 103.244.91.128 port 41816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:13:04 host2 sshd[855614]: Disconnected from invalid user tomcat 103.76.120.35 port 50536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:14:11 host2 sshd[856799]: Disconnected from invalid user tao 103.244.91.128 port 37466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:14:38 host2 sshd[857129]: Disconnected from invalid user smith 77.192.248.233 port 11787 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:14:28 host2 sshd[857018]: Disconnected from invalid user www 103.76.120.35 port 40668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:16:09 host2 sshd[858827]: Disconnected from invalid user tobias 203.161.184.246 port 44726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:15:40 host2 sshd[858340]: Disconnected from invalid user user01 101.36.108.134 port 47448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:15:49 host2 sshd[858476]: Disconnected from invalid user newuser 119.92.70.82 port 53882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:16:21 host2 sshd[859087]: Disconnected from invalid user myftp 134.209.225.104 port 41796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:16:59 host2 sshd[859682]: Disconnected from invalid user t 104.168.4.151 port 38552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:17:10 host2 sshd[859920]: Disconnected from invalid user tao 101.36.108.134 port 51376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:17:15 host2 sshd[860133]: Disconnected from invalid user qihang 103.76.120.35 port 45444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:16:43 host2 sshd[859406]: Disconnected from invalid user eacadm 205.185.125.150 port 50000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:18:00 host2 sshd[860795]: Disconnected from invalid user user01 77.192.248.233 port 53692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:18:35 host2 sshd[861315]: Disconnected from invalid user axel 205.185.125.150 port 49406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:20:14 host2 sshd[863166]: Disconnected from invalid user raccmcserver 104.168.4.151 port 38898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.34
country_id: 2510769
description:
Nov 20 04:19:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=139.28.190.34, lip=66.85.158.91, TLS, session=<4yHrY/pDnryLHL4i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.135
country_id: 3469034
description:
Nov 20 04:19:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.96.135, lip=66.85.158.91, TLS, session=<dWYCZfpDt8+/8GCH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:21:16 host2 sshd[864335]: Disconnected from invalid user magento 104.168.4.151 port 39010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:22:24 host2 sshd[865436]: Disconnected from invalid user aaa 205.185.125.150 port 48218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:23:41 host2 sshd[868321]: Disconnected from invalid user magento 103.76.120.35 port 43806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-11-20 04:28:42 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:57074: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Nov 20 04:28:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.148, lip=66.85.158.92, TLS: Connection closed, session=<iOSxhfpDDpjHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-20 04:29:27 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1219: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-20 04:29:46 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:36085: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.252.27.223
country_id: 6252001
description:
Nov 20 04:29:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.252.27.223, lip=66.85.158.92, TLS: Connection closed, session=<uBq3ifpDWIMs/Bvf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-20 04:30:04 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:38041: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 04:30:50 host2 sshd[873118]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 04:32:17 host2 sshd[873913]: Disconnected from invalid user user 2.57.121.25 port 29236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-20 04:34:32 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:40204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.198
country_id: 6252001
description:
Nov 20 04:35:08 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.198, lip=66.85.158.92, session=<XmGWnPpD5h6s7OTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.185.98.251
country_id: 6252001
description:
2025-11-20 04:35:11 dovecot_login authenticator failed for (47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net) [47.185.98.251]:20076: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.216
country_id: 2395170
description:
Nov 20 04:36:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=154.127.36.216, lip=66.85.158.91, TLS, session=<fd55ofpDWOyafyTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.20
country_id: 99237
description:
Nov 20 04:37:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=65.20.136.20, lip=66.85.158.91, TLS, session=<5xGaovpDkrRBFIgU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:47:04 host2 sshd[882898]: Disconnected from invalid user ian 185.202.207.17 port 55310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov 20 04:47:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, session=<FJvpyfpDNJmsaAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Nov 20 04:50:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lAf/0/pDpd7G6xik>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:51:13 host2 sshd[885219]: Disconnected from invalid user joel 66.96.239.187 port 46802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 04:51:38 host2 sshd[885492]: Disconnected from invalid user chen 103.123.227.244 port 38286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:52:31 host2 sshd[885933]: Disconnected from invalid user huake 66.96.239.187 port 33936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 20 04:54:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, session=<htm34PpDaMCUcdZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:55:04 host2 sshd[887895]: Disconnected from invalid user user 66.96.239.187 port 39148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:55:46 host2 sshd[888604]: Disconnected from invalid user huake 185.202.207.17 port 40306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:56:12 host2 sshd[888966]: Disconnected from invalid user gp 219.89.194.78 port 36890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:56:24 host2 sshd[889064]: Disconnected from invalid user deployer 66.96.239.187 port 33190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:57:50 host2 sshd[889810]: Disconnected from invalid user mm 219.89.194.78 port 44236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-20 04:58:55 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (auganhomia) [74.218.95.154]:50576: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.87.153
country_id: 6252001
description:
Nov 20 04:59:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.144.87.153, lip=66.85.158.91, TLS: Connection closed, session=<giYB8vpD9LoSkFeZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:01:17 host2 sshd[892082]: Disconnected from invalid user ob 103.123.227.244 port 53858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:02:57 host2 sshd[892934]: Disconnected from invalid user admin 219.89.194.78 port 60472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Nov 20 05:04:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sI0CBftDL83N0h9W>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 05:06:12 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (paderimete) [81.225.30.107]:52337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:08:05 host2 sshd[896518]: Disconnected from invalid user iptv 103.123.227.244 port 37300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:08:22 host2 sshd[896660]: Disconnected from invalid user deployer 219.89.194.78 port 49330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:11:24 host2 sshd[898814]: Disconnected from invalid user eric 118.193.61.63 port 13634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:11:28 host2 sshd[898830]: Disconnected from invalid user maria 103.123.227.244 port 43904 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.100
country_id: 3017382
description:
Nov 20 05:11:32 host2 pure-ftpd[898882]: (?@91.196.152.100) [INFO] New connection from 91.196.152.100


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.102
country_id: 3017382
description:
Nov 20 05:11:34 host2 pure-ftpd[898895]: (?@91.196.152.102) [INFO] New connection from 91.196.152.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.34.116
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.254.34.116 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:14:03 host2 sshd[900380]: Disconnected from invalid user info 118.193.61.63 port 13674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.85
country_id: 3865483
description:
Nov 20 05:15:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.195.85, lip=66.85.158.91, TLS, session=<S/egLPtDAc614cNV>


