# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 07:30:31 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:37592: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-09 07:30:40 dovecot_login authenticator failed for H=(syn-075-183-106-192.res.spectrum.com) [75.183.106.192]:48935: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WvHG6upHdBVAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<9Aad7OpHpF1APpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-09 07:34:04 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:53587: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:34:36 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:45396: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Jan  9 07:43:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.219, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EMLnE+tHMbNb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.28
country_id: 3017382
description:
Jan  9 07:44:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.28, lip=66.85.158.91, TLS: Connection closed, session=<lIqHFOtHhZpb51kc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.218
country_id: 3017382
description:
Jan  9 07:44:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.218, lip=66.85.158.91, TLS: Connection closed, session=<dPh1FetHp9Vb51na>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-09 07:46:30 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:34608: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-09 07:46:06 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:56125: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.45
country_id: 2921044
description:
2026-01-09 07:47:20 dovecot_login authenticator failed for H=(ADMIN) [45.88.97.45]:24357: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-09 07:47:31 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:49707: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-09 07:46:52 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:56859: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-09 07:47:55 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:42376: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.179
country_id: 3017382
description:
Jan  9 07:48:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.179, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mmm6I+tH4apbxJiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.183
country_id: 3017382
description:
Jan  9 07:48:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.183, lip=66.85.158.91, TLS: Connection closed, session=<171aJOtH88lbxJi3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Jan  9 07:48:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.210, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TxQmJetHc5pbxJjS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.215
country_id: 3017382
description:
Jan  9 07:48:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.215, lip=66.85.158.91, TLS: Connection closed, session=<0EFWJetHcdVbxJjX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:15 host2 sshd[1238254]: Disconnected from invalid user admin1 13.73.111.251 port 43156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:53 host2 sshd[1238693]: Disconnected from invalid user ubuntu 13.73.111.251 port 54838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:52:15 host2 sshd[1239772]: Disconnected from invalid user user1 13.73.111.251 port 48340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 07:54:00 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (plized) [174.166.153.20]:43622: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-09 07:53:56 dovecot_plain authenticator failed for H=(crohan) [50.217.40.11]:59830: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:56:00 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:41604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-09 07:56:20 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:52126: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-09 08:03:44 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61613: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-09 08:06:57 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:45505: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-09 08:09:39 dovecot_login authenticator failed for H=([85.152.57.60]) [85.152.57.60]:43196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2026-01-09 08:10:12 dovecot_login authenticator failed for H=([117.205.2.9]) [117.205.2.9]:35622: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-09 08:10:35 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:51526: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-01-09 08:10:55 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:48670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.75.2
country_id: 6252001
description:
Jan  9 08:13:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.75.2, lip=66.85.158.92, session=<sxg4futHCq0UDksC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.147
country_id: 6252001
description:
2026-01-09 08:14:54 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.147]:51396: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:15:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MUVZg+tH4tWi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<j/y0hutHiPSi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  9 08:17:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<bc/KiutH4H1ChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<03v1ietHLOai2JbM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.226.241
country_id: 290291
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.226.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 08:19:08 dovecot_plain authenticator failed for H=(nially) [102.53.15.180]:58698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-09 08:20:36 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:41618: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.221.68
country_id: 2510769
description:
2026-01-09 08:21:15 dovecot_login authenticator failed for H=68.red-79-154-221.dynamicip.rima-tde.net [79.154.221.68]:43919: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-09 08:23:09 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:35165: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-09 08:23:46 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:39313: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-09 08:23:59 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:34915: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:24:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS, session=<lcBFo+tH0Oei2JbM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-09 08:24:28 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:56768: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-09 08:25:09 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:44782: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-09 08:25:34 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:56698: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-09 08:25:41 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:49820: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 08:26:07 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:45010: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:27:40 host2 sshd[1267977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.169.18.6
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 62.169.18.6: 465 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:32:02 host2 sshd[1271883]: Disconnected from invalid user admin1 5.29.135.63 port 44056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-09 08:32:58 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (unble) [68.82.141.145]:52744: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:33:10 host2 sshd[1272815]: Disconnected from invalid user user 5.29.135.63 port 57818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-09 08:33:23 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (augnated) [68.40.189.43]:60798: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-09 08:38:27 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.70
country_id: 6252001
description:
Jan  9 08:38:34 host2 pure-ftpd[1277003]: (?@20.118.209.70) [INFO] New connection from 20.118.209.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 08:39:08 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:60412: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:41:53 host2 sshd[1279797]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.105.135
country_id: 3865483
description:
Jan  9 08:41:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.238.105.135, lip=66.85.158.91, TLS, session=<4+EX4utHF8Et7mmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.50
country_id: 3469034
description:
Jan  9 08:42:17 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.39.142.50, lip=66.85.158.91, TLS, session=<M5B14+tH8Z2xJ44y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2026-01-09 08:43:23 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se [155.4.72.204]:56021: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-09 08:43:13 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:35378: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-09 08:45:02 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (brime) [98.40.101.10]:54584: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.185.206
country_id: 6252001
description:
Jan  9 08:46:32 host2 pure-ftpd[1284550]: (?@40.124.185.206) [INFO] New connection from 40.124.185.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 08:48:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (overaps) [87.103.126.54]:19227: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Jan  9 08:48:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.91, session=<URIY/OtHcvWTuYR7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-09 08:52:30 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:38062: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-09 08:53:22 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:50282: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-09 08:53:46 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:45192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-09 08:53:56 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:60356: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-09 08:57:09 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:51236: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Jan  9 08:57:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XwZTG+xHCM/G6xjJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-09 08:56:51 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:45093: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.12
country_id: 2186224
description:
2026-01-09 08:58:19 dovecot_login authenticator failed for H=([121.73.168.12]) [121.73.168.12]:40402: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-09 08:57:52 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41254: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-09 08:59:39 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (fresings) [81.226.88.121]:59224: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 09:00:28 dovecot_plain authenticator failed for H=(maimbols) [38.248.111.238]:38461: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  9 09:00:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<hGoCJ+xH5pmSvhb3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-09 09:02:24 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:45561: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-09 09:02:37 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:51567: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.48.131
country_id: 2750405
description:
2026-01-09 09:05:02 dovecot_login authenticator failed for H=(ADMIN) [212.56.48.131]:58092: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-09 09:06:27 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (crantly) [73.196.144.25]:55994: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-09 09:09:20 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53162: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-09 09:09:08 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:54744: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:15:26 host2 sshd[1312257]: Disconnected from invalid user ubuntu 109.241.24.186 port 36368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-09 09:16:11 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:34891: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:27 host2 sshd[1313100]: Disconnected from invalid user ubuntu 43.157.2.238 port 42612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-09 09:16:38 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:38770: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:56 host2 sshd[1313398]: Disconnected from invalid user deploy 43.157.2.238 port 47776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:16:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4jWqYOxHmMYDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:17:18 host2 sshd[1313663]: Disconnected from invalid user admin 109.241.24.186 port 52964 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:18:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XIqxZOxHSroDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-09 09:18:49 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:45289: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-09 09:19:03 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:47112: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:18:26 host2 sshd[1314509]: Disconnected from invalid user user 109.241.24.186 port 39172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:20:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<niqHa+xH0u0DjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:20:09 host2 sshd[1315911]: Disconnected from invalid user test 109.241.24.186 port 58566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Jan  9 09:20:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ntzCbuxHO9PN0h/G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:22:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q4OqdexHgoQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 09:23:22 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:58102: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:23:31 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YI4DeOxHXKsDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-09 09:23:38 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:52554: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:25:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=</Gerf+xHFIEDjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.81.126
country_id: 1880251
description:
Jan  9 09:27:57 host2 pure-ftpd[1322213]: (?@47.245.81.126) [INFO] New connection from 47.245.81.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2026-01-09 09:29:08 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.10]:38380: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 09:28:47 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (puradisfic) [73.213.237.28]:53622: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2026-01-09 09:29:15 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.10]:17770: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.79
country_id: 2510769
description:
Jan  9 09:31:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.214.138.79, lip=66.85.158.91, TLS, session=<BHxdk+xH85O51opP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.216
country_id: 2963597
description:
Jan  9 09:31:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=89.106.141.216, lip=66.85.158.91, TLS, session=</mRjlOxH/IdZao3Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.87
country_id: 6252001
description:
Jan  9 09:35:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.87, lip=66.85.158.91, TLS, session=<5L6CouxHAOmTuYRX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-09 09:36:43 dovecot_login authenticator failed for H=([182.95.227.70]) [182.95.227.70]:42428: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-09 09:37:03 dovecot_login authenticator failed for H=([46.212.127.128]) [46.212.127.128]:41802: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-09 09:43:00 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:60558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-09 09:43:24 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:52334: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 09:43:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tived) [87.103.126.54]:41213: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-09 09:46:08 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:56738: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-09 09:46:20 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:39979: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-09 09:49:38 dovecot_login authenticator failed for H=(test) [93.123.109.93]:58473: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-09 09:51:02 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:43214: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-09 09:51:15 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:36426: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-09 09:57:50 dovecot_plain authenticator failed for H=(unshely) [65.20.174.63]:40369: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.159
country_id: 1269750
description:
Jan  9 09:58:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.159, lip=66.85.158.91, TLS, session=<FfTH9OxH/5xnpPaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.55.226.10
country_id: 798544
description:
Jan  9 09:58:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=92.55.226.10, lip=66.85.158.91, TLS, session=<BPRZ9exH4qVcN+IK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-09 09:59:01 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:55363: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.104
country_id: 3469034
description:
Jan  9 09:59:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=177.44.96.104, lip=66.85.158.91, TLS, session=<SXj69exHS+exLGBo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.54.18.202
country_id: 2623032
description:
Jan  9 09:58:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=87.54.18.202, lip=66.85.158.91, TLS, session=<uMC19OxHjb1XNhLK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.159.123.19
country_id: 3865483
description:
Jan  9 09:59:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.159.123.19, lip=66.85.158.91, TLS, session=<EYzh9exHXOS6n3sT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.96
country_id: 3865483
description:
Jan  9 09:59:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.249.96, lip=66.85.158.91, TLS, session=<nxfi9exHAp6zAPlg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.209
country_id: 298795
description:
Jan  9 09:58:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.67.155.209, lip=66.85.158.91, TLS, session=<Dp289OxHGO0tQ5vR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.13.110.39
country_id: 3865483
description:
Jan  9 09:58:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.13.110.39, lip=66.85.158.91, TLS, session=<cdrJ9OxH7se1DW4n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2026-01-09 09:59:23 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:35531: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.201
country_id: 3175395
description:
Jan  9 09:59:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.201, lip=66.85.158.91, TLS, session=</GI69+xHHp/ZGrPJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.127.63.9
country_id: 1605651
description:
2026-01-09 09:59:45 dovecot_login authenticator failed for H=([45.127.63.9]) [45.127.63.9]:58094: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.3.89
country_id: 690791
description:
Jan  9 09:59:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.3.89, lip=66.85.158.91, TLS, session=<SIgJ9+xH24CwZwNZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.21
country_id: 718075
description:
2026-01-09 10:01:47 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.21]:45095: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  9 10:01:14 host2 pure-ftpd[1351014]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-09 10:06:28 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:55084: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-09 10:06:40 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:51090: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2026-01-09 10:07:50 dovecot_login authenticator failed for H=6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:38892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-09 10:07:12 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:52424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-09 10:10:25 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:37298: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.186
country_id: 953987
description:
Jan  9 10:14:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.129.57.186, lip=66.85.158.91, TLS, session=<p5HRK+1HkadmgTm6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.78
country_id: 690791
description:
Jan  9 10:13:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.78, lip=66.85.158.91, TLS, session=<vCO0Ku1HBc/CLIxO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.138.58.198
country_id: 6252001
description:
Jan  9 10:14:47 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.138.58.198, lip=66.85.158.91, session=<WslYL+1H1I0iijrG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 10:15:22 host2 sshd[1364473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.44.106
country_id: 6252001
description:
Jan  9 10:15:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=34.75.44.106, lip=66.85.158.91, session=<0cY/Me1HitQiSyxq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Jan  9 10:19:50 host2 sshd[1368293]: Disconnected from invalid user ubuntu 67.10.185.103 port 43014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.109.221
country_id: 2921044
description:
Jan  9 10:20:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.109.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GIJhQu1H/GCd5m3d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.183
country_id: 2921044
description:
Jan  9 10:19:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.252.183, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<vw9IQO1H/5mkXPy3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.45
country_id: 3175395
description:
Jan  9 10:19:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=195.177.113.45, lip=66.85.158.91, TLS, session=<7/NFQO1HFNvDsXEt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-09 10:20:56 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:52457: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.101
country_id: 2510769
description:
Jan  9 10:20:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.214.138.101, lip=66.85.158.91, TLS, session=<8lAWQu1HsLO51opl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:20:25 host2 sshd[1368973]: Disconnected from invalid user user1 152.32.171.99 port 58738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-01-09 10:21:27 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:34792: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:21:42 host2 sshd[1370009]: Disconnected from invalid user ubuntu 152.32.171.99 port 39674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-09 10:21:44 dovecot_login authenticator failed for H=(nsg-static-193.132.71.182.airtel.in) [182.79.83.98]:49954: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:22:50 host2 sshd[1370900]: Disconnected from invalid user ubuntu 152.32.171.99 port 41994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  9 10:23:27 host2 sshd[1371288]: Disconnected from invalid user ubuntu 152.32.171.99 port 52142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-09 10:23:18 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:59116: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-09 10:23:28 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:3215: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-09 10:25:26 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:57324: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2026-01-09 10:25:45 dovecot_login authenticator failed for H=([49.124.155.177]) [49.124.155.177]:40344: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.48
country_id: 953987
description:
2026-01-09 10:27:22 dovecot_login authenticator failed for H=(ADMIN) [154.47.30.48]:52382: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 10:29:35 host2 sshd[1376905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 10:30:08 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:33408: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-09 10:30:33 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:56962: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-09 10:31:15 dovecot_plain authenticator failed for H=(molograted) [5.32.61.6]:54531: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-09 10:31:19 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (tried) [196.47.172.253]:50760: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-09 10:31:22 dovecot_plain authenticator failed for H=(ovels) [24.105.248.218]:54214: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-09 10:31:49 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:57280: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-09 10:35:05 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:58814: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-09 10:35:37 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:58436: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-09 10:41:08 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:61161: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:41:20 host2 sshd[1386592]: Disconnected from invalid user user 155.4.244.107 port 35697 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 10:41:31 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:44064: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-01-09 10:43:40 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:40122: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:44:23 host2 sshd[1388632]: Disconnected from invalid user user1 155.4.244.107 port 36246 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.250.128.158
country_id: 1733045
description:
Jan  9 10:45:24 host2 pure-ftpd[1389538]: (?@47.250.128.158) [INFO] New connection from 47.250.128.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-09 10:45:27 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (vatanism) [24.15.216.41]:33164: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Jan  9 10:46:11 host2 sshd[1390133]: Disconnected from invalid user admin 155.4.244.107 port 31007 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 10:47:34 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:37534: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Jan  9 10:47:13 host2 sshd[1390961]: Disconnected from invalid user test 45.249.247.165 port 45398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-09 10:48:21 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:59284: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.48.177.141
country_id: 2661886
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 13.48.177.141 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.249.247.165
country_id: 1819730
description:
Jan  9 10:50:25 host2 sshd[1393600]: Received disconnect from 45.249.247.165 port 57456:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:52:18 host2 sshd[1396064]: Disconnected from invalid user admin 117.192.236.125 port 37942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:53:33 host2 sshd[1397446]: Disconnected from invalid user user 117.192.236.125 port 54967 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:54:49 host2 sshd[1398915]: Disconnected from invalid user deploy 117.192.236.125 port 43367 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-09 10:55:13 dovecot_plain authenticator failed for H=(deidic) [24.105.248.218]:39034: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-09 10:55:45 dovecot_plain authenticator failed for H=(chrubdinal) [65.20.133.208]:55743: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 10:57:49 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (sommists) [67.172.54.29]:60712: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.136
country_id: 953987
description:
Jan  9 10:57:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.129.51.136, lip=66.85.158.91, TLS, session=<jIhxxu1Hx5ZmgTOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.121.95.197
country_id: 3469034
description:
Jan  9 10:57:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.121.95.197, lip=66.85.158.91, TLS, session=<23zpx+1HlZiKeV/F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.192.236.125
country_id: 1269750
description:
Jan  9 10:58:40 host2 sshd[1402088]: Disconnected from invalid user user1 117.192.236.125 port 57120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 10:59:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (almoconic) [87.103.126.54]:50510: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 11:02:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<21Rl2u1HaNFChJmF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 11:03:47 host2 sshd[1406049]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Jan  9 11:04:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Dnlv4u1HNsbN0h/P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.130
country_id: 1733045
description:
2026-01-09 11:08:07 dovecot_login authenticator failed for H=([49.124.142.130]) [49.124.142.130]:52466: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-09 11:08:57 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:56792: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-09 11:08:32 dovecot_login authenticator failed for H=([182.95.229.38]) [182.95.229.38]:43228: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-09 11:08:31 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:60342: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  9 11:09:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<q/hh8+1H5M3N0h/E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-09 11:13:54 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:47259: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-09 11:14:03 dovecot_login authenticator failed for H=(251.218.8.81.sta.ac-net.se) [81.8.218.251]:46286: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-09 11:17:09 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:38218: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-09 11:17:20 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:49342: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.50
country_id: 3144096
description:
2026-01-09 11:20:51 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.50]:23540: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.6.125
country_id: 3077311
description:
Jan  9 11:21:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=31.222.6.125, lip=66.85.158.91, TLS, session=<JuUQHO5HOOgf3gZ9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.49
country_id: 3469034
description:
Jan  9 11:21:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=190.89.137.49, lip=66.85.158.91, TLS, session=<oNIwHe5HlNO+WYkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 11:22:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cluous) [87.103.126.54]:30302: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.165.171
country_id: 6252001
description:
Jan  9 11:26:26 host2 pure-ftpd[1424263]: (?@20.98.165.171) [INFO] New connection from 20.98.165.171


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.144.87
country_id: 2921044
description:
Jan  9 11:28:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.144.87, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<yoILN+5HIzGl45BX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.57
country_id: 6252001
description:
Jan  9 11:29:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<661kOe5H/cKTuYQ5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-09 11:29:46 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:34175: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.162.246
country_id: 2921044
description:
Jan  9 11:29:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.92.162.246, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZiwnOe5HHs2kXKL2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-09 11:30:04 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:53100: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-09 11:32:44 dovecot_login authenticator failed for H=([182.95.54.10]) [182.95.54.10]:51124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-09 11:33:31 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:33298: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-09 11:33:38 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:44632: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-09 11:34:07 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:36146: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:34:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RYhcTe5Hrcqi2JaT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:35:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<g6F6Ue5HWO6i2JaT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 11:38:08 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:32858: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.245.13.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.245.13.114 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 11:40:42 host2 sshd[1434726]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.147
country_id: 6252001
description:
Jan  9 11:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.147, lip=66.85.158.92, TLS, session=<A/gtau5HFuKi2JaT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-01-09 11:45:14 dovecot_login authenticator failed for H=([49.124.155.180]) [49.124.155.180]:57544: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-09 11:45:51 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (aniant) [217.215.74.195]:37432: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.12
country_id: 3194884
description:
2026-01-09 11:49:01 dovecot_login authenticator failed for H=(ADMIN) [176.125.229.12]:64296: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-09 11:57:54 dovecot_plain authenticator failed for H=(ority) [103.51.26.198]:32902: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.76.184
country_id: 2750405
description:
Jan  9 11:58:41 host2 pure-ftpd[1449376]: (?@64.227.76.184) [INFO] New connection from 64.227.76.184


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.82.181
country_id: 1880251
description:
Jan  9 11:58:47 host2 pure-ftpd[1449442]: (?@146.190.82.181) [INFO] New connection from 146.190.82.181


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.72.74.162
country_id: 6252001
description:
Jan  9 12:02:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.72.74.162, lip=66.85.158.91, session=<Eu0Vse5HZI5ASEqi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 12:03:13 host2 sshd[1452852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.179.34
country_id: 1880251
description:
Jan  9 12:02:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=188.166.179.34, lip=66.85.158.91, TLS, session=<kCSjsO5H5Le8prMi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.56.0.19
country_id: 3469034
description:
Jan  9 12:03:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr>, method=PLAIN, rip=189.56.0.19, lip=66.85.158.91, session=<8AqDsu5HbKC9OAAT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Jan  9 12:03:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, TLS, session=<6/3Bsu5HeNBR6evL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.186.54.65
country_id: 298795
description:
Jan  9 12:02:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=78.186.54.65, lip=66.85.158.91, TLS, session=<Z2RMse5HLoVOujZB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.229.5.248
country_id: 3175395
description:
Jan  9 12:02:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=95.229.5.248, lip=66.85.158.91, session=<YjkWsu5HHpFf5QX4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.41
country_id: 2921044
description:
Jan  9 12:03:03 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.68.70.41, lip=66.85.158.91, TLS, session=<JbaLsu5HOmyKREYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.19.195.12
country_id: 3144096
description:
Jan  9 12:03:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=85.19.195.12, lip=66.85.158.91, TLS, session=</BZTsu5Htq5VE8MM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2026-01-09 12:04:00 dovecot_login authenticator failed for H=([103.93.37.178]) [103.93.37.178]:43882: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-09 12:04:12 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:57366: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-09 12:07:01 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:55957: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-09 12:07:16 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:56088: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.216.188
country_id: 1694008
description:
2026-01-09 12:06:53 dovecot_plain authenticator failed for H=(U289EEWT) [120.28.216.188]:9045: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-09 12:13:03 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:54928: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 12:17:26 host2 sshd[1463926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  9 12:20:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, TLS: Connection closed, session=<j+jY8e5H9sinXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-09 12:21:38 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:55115: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-09 12:21:50 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:49197: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.3
country_id: 289688
description:
2026-01-09 12:22:17 dovecot_login authenticator failed for H=(ADMIN) [95.181.234.3]:22028: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.181
country_id: 2215636
description:
2026-01-09 12:23:41 dovecot_plain authenticator failed for H=(heels) [102.38.3.181]:46652: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2026-01-09 12:23:44 dovecot_plain authenticator failed for H=c-73-0-235-30.hsd1.fl.comcast.net (synatralic) [73.0.235.30]:52298: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-09 12:25:41 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:36710: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-09 12:26:45 dovecot_plain authenticator failed for H=(unkly) [75.97.190.237]:41829: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-09 12:26:37 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:40416: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 12:28:15 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (daenon) [67.172.54.29]:46088: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2026-01-09 12:28:32 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:59765: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-09 12:28:44 dovecot_login authenticator failed for H=([125.17.198.33]) [182.95.178.126]:56196: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-09 12:29:05 dovecot_plain authenticator failed for H=(amfulecle) [65.20.133.4]:57138: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Jan  9 12:29:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oFfHEu9HacHN0h/z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.86
country_id: 1733045
description:
2026-01-09 12:33:40 dovecot_login authenticator failed for H=([49.125.201.86]) [49.125.201.86]:56262: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  9 12:33:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<p1UxIe9H+kBChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  9 12:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<b0m9QO9H1JOLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  9 12:43:56 host2 sshd[1484396]: Disconnected from invalid user admin 103.217.144.113 port 59340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-09 12:44:38 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:59170: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-09 12:44:49 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:43358: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Jan  9 12:46:38 host2 sshd[1486518]: Disconnected from invalid user deploy 20.193.141.133 port 24244 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Jan  9 12:47:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<Q9iUUO9HLKZV2ZUJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Jan  9 12:47:49 host2 sshd[1487425]: Disconnected from invalid user deploy 20.193.141.133 port 17771 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-09 12:48:02 dovecot_login authenticator failed for H=([152.52.218.233]) [182.78.79.134]:60746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-09 12:48:26 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:46198: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2026-01-09 12:48:27 dovecot_login authenticator failed for H=([182.95.22.249]) [128.185.194.22]:35806: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-09 12:49:18 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:42762: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-09 12:48:52 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:44790: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 12:49:08 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:54172: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-01-09 12:49:07 dovecot_login authenticator failed for H=([49.124.151.69]) [49.124.151.69]:52914: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-09 12:50:17 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:54090: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-09 12:49:57 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:57628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan  9 12:51:08 host2 sshd[1490236]: Disconnected from invalid user admin 52.237.80.79 port 53000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-09 12:51:33 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:50565: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Jan  9 12:51:44 host2 sshd[1490601]: Disconnected from invalid user user1 52.237.80.79 port 49618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-09 12:51:53 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:55772: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  9 12:51:57 host2 sshd[1490739]: Disconnected from invalid user deploy 142.93.212.130 port 54734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.72
country_id: 3469034
description:
Jan  9 12:52:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=191.53.40.72, lip=66.85.158.91, TLS, session=<gzGjYu9H5c6/NShI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.48
country_id: 1269750
description:
Jan  9 12:52:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.109.178.48, lip=66.85.158.91, TLS, session=<CmHpY+9HPORnbbIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.9
country_id: 6252001
description:
2026-01-09 12:53:32 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.9]:10676: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  9 12:54:22 host2 sshd[1492639]: Disconnected from invalid user ubuntu 142.93.212.130 port 36000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.52
country_id: 6252001
description:
Jan  9 12:55:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.52, lip=66.85.158.92, TLS, session=<WvTlbe9HYuLG6xg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.208
country_id: 3175395
description:
Jan  9 13:03:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=171.22.233.208, lip=66.85.158.91, TLS, session=<seBaie9HNZurFunQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-09 13:03:43 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:45344: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.97.66
country_id: 3469034
description:
Jan  9 13:03:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=167.249.97.66, lip=66.85.158.91, TLS, session=<zdF3iu9HMoWn+WFC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2026-01-09 13:04:07 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:59844: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.137.85
country_id: 690791
description:
Jan  9 13:05:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=37.221.137.85, lip=66.85.158.91, TLS, session=<SFqhkO9HVIIl3YlV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.204
country_id: 3865483
description:
Jan  9 13:05:47 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.252.204, lip=66.85.158.91, TLS, session=<PVe+ke9H7N2zAPzM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-09 13:06:24 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:44938: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-09 13:06:43 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:58026: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-09 13:09:44 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (miste) [174.169.224.27]:32834: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 13:09:48 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (diserys) [87.103.126.54]:1795: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-01-09 13:13:41 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:56440: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-09 13:13:50 dovecot_plain authenticator failed for H=(noide) [185.209.108.42]:56196: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-01-09 13:14:08 dovecot_login authenticator failed for H=([125.19.163.58]) [125.19.163.58]:52034: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-09 13:16:36 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:48006: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 13:17:05 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:59720: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-09 13:17:09 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:56814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-09 13:17:29 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:55716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-09 13:21:14 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:45960: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.36
country_id: 798544
description:
Jan  9 13:22:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=91.228.33.36, lip=66.85.158.91, TLS, session=<kpA5zu9Hnulb5CEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-09 13:22:20 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:43850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.73.237
country_id: 1269750
description:
Jan  9 13:22:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.255.73.237, lip=66.85.158.91, TLS, session=<8EQPze9HhZBn/0nt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.13
country_id: 2562770
description:
2026-01-09 13:25:49 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.13]:36295: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-09 13:30:06 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:39762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-09 13:30:36 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:42178: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:35:42 host2 sshd[1526662]: Disconnected from invalid user admin1 156.54.170.192 port 56268 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.103.217
country_id: 2921044
description:
Jan  9 13:36:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=142.93.103.217, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Dwxe/+9HAYKOXWfZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:36:12 host2 sshd[1527025]: Disconnected from invalid user deploy 156.54.170.192 port 33723 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.72.34
country_id: 2921044
description:
Jan  9 13:36:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=64.226.72.34, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ov+AAfBHKnxA4kgi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  9 13:37:08 host2 sshd[1527630]: Disconnected from invalid user test 201.186.40.250 port 34952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:37:14 host2 sshd[1527689]: Disconnected from invalid user deploy 156.54.170.192 port 45099 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.171.221
country_id: 2921044
description:
Jan  9 13:38:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.171.221, lip=66.85.158.91, session=<p8q0CPBHlZSl46vd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.70.87
country_id: 2921044
description:
Jan  9 13:38:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.70.87, lip=66.85.158.91, session=<m0TBCPBHRraGekZX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 13:38:09 dovecot_plain authenticator failed for H=(pesis) [76.190.155.43]:50782: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-09 13:39:21 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:42144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  9 13:39:10 host2 sshd[1529064]: Disconnected from invalid user user 156.54.170.192 port 39617 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  9 13:39:49 host2 sshd[1529494]: Disconnected from invalid user admin 201.186.40.250 port 52526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:41:34 host2 sshd[1530849]: Disconnected from invalid user ubuntu 178.128.243.225 port 41450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:42:02 host2 sshd[1531124]: Disconnected from invalid user user 178.128.243.225 port 48194 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 178.128.243.225
country_id: 2750405
description:
Jan  9 13:43:26 host2 sshd[1532282]: Received disconnect from 178.128.243.225 port 40798:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-09 13:44:18 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:47262: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-09 13:44:36 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:48580: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-09 13:44:01 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:60482: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-09 13:45:39 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:50766: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-01-09 13:45:55 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network [202.62.129.18]:51430: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.162.246
country_id: 2921044
description:
Jan  9 13:48:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=164.92.162.246, lip=66.85.158.92, TLS handshaking: Connection closed, session=<seusKvBHrkGkXKL2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.194
country_id: 6252001
description:
Jan  9 13:49:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.194, lip=66.85.158.91, TLS, session=<682rLvBH0PjN0h/C>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 13:50:32 host2 pure-ftpd[1538122]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 13:50:50 host2 sshd[1538268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.68.242
country_id: 2921044
description:
Jan  9 13:53:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.68.242, lip=66.85.158.91, TLS, session=<TTjTO/BHcJxA4kTy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.47
country_id: 2542007
description:
2026-01-09 13:58:21 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.47]:36034: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-09 13:59:25 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:45994: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-01-09 14:00:00 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:21353: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 14:02:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unonseping) [87.103.126.54]:4787: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-09 14:02:45 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (ancesinag) [73.0.191.33]:38096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2026-01-09 14:04:16 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:47594: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-09 14:04:26 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:53518: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 14:05:03 host2 sshd[1550181]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.146
country_id: 3017382
description:
Jan  9 14:08:17 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.146, lip=66.85.158.91, session=<wlZkcvBHU4db51mS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.233
country_id: 3017382
description:
Jan  9 14:07:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.233, lip=66.85.158.91, session=<SsrdcPBHSZZb51np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2026-01-09 14:07:51 dovecot_login authenticator failed for H=([64.37.198.190]) [64.37.198.190]:54697: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.147
country_id: 3017382
description:
Jan  9 14:08:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.147, lip=66.85.158.91, session=<vOZ6cfBH9+Vb51mT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.148
country_id: 3017382
description:
Jan  9 14:08:13 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.148, lip=66.85.158.91, session=<W+QxcvBHR4Jb51mU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-09 14:08:34 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:49784: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-09 14:08:52 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:34238: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-09 14:09:11 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:41888: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-09 14:09:19 dovecot_login authenticator failed for H=([182.95.178.158]) [182.95.178.158]:56520: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-09 14:14:59 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:44624: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-09 14:15:05 dovecot_login authenticator failed for H=([61.246.26.65]) [182.95.230.158]:47046: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2026-01-09 14:14:38 dovecot_login authenticator failed for H=172.43.246.220.static.netvigator.com [220.246.43.172]:57106: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-09 14:14:46 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:46324: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 14:16:02 host2 sshd[1560155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.164
country_id: 1733045
description:
2026-01-09 14:15:51 dovecot_login authenticator failed for H=([49.124.154.164]) [49.124.154.164]:36128: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-09 14:16:10 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:49876: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-09 14:18:15 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:53246: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-09 14:18:38 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:54034: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-09 14:20:53 dovecot_plain authenticator failed for H=(hommulados) [149.62.239.4]:53352: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  9 14:28:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<HITpuPBH5P7CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-09 14:31:02 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (phaterier) [196.47.172.253]:58239: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-09 14:31:07 dovecot_plain authenticator failed for H=(copite) [65.20.174.63]:33907: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.28
country_id: 718075
description:
2026-01-09 14:30:26 dovecot_login authenticator failed for H=(ADMIN) [185.225.31.28]:15217: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.158
country_id: 1814991
description:
Jan  9 14:33:06 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.158, lip=66.85.158.91, session=<Z94ty/BH2cBe586e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1814991
description:
Jan  9 14:32:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.202, lip=66.85.158.91, session=<VeSWyfBH9epe587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.200
country_id: 1814991
description:
Jan  9 14:32:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.200, lip=66.85.158.91, session=<5b81yvBHpZZe587I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1814991
description:
Jan  9 14:33:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.205, lip=66.85.158.91, session=<rm9ny/BHz8Fe587N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-09 14:36:10 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:58998: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2026-01-09 14:36:35 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:38956: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:38:41 host2 sshd[1578190]: Disconnected from invalid user admin 152.42.229.152 port 36258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:41:18 host2 sshd[1580371]: Disconnected from invalid user ubuntu 152.42.229.152 port 52774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-09 14:43:59 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:43300: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-09 14:44:04 dovecot_plain authenticator failed for H=(baliss) [24.187.213.29]:54670: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.229.152
country_id: 1880251
description:
Jan  9 14:44:30 host2 sshd[1582826]: Disconnected from invalid user admin1 152.42.229.152 port 55878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.80.143
country_id: 3175395
description:
2026-01-09 14:44:32 dovecot_login authenticator failed for H=([2.192.80.143]) [2.192.80.143]:37240: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-09 14:46:11 dovecot_plain authenticator failed for H=(glogulis) [80.227.147.94]:59605: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2026-01-09 14:46:37 dovecot_login authenticator failed for H=([49.124.152.208]) [49.124.152.208]:54046: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-09 14:47:59 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:56557: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-09 14:47:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:33654: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-09 14:48:23 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:2160: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-09 14:51:43 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48512: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 14:51:53 host2 pure-ftpd[1588841]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-09 14:51:11 dovecot_login authenticator failed for H=([196.191.212.226]) [213.55.85.202]:4789: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-09 14:53:51 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (sneptna) [98.195.138.52]:39042: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 14:59:06 host2 pure-ftpd[1594933]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 15:00:16 dovecot_plain authenticator failed for H=(cardisess) [38.248.111.238]:34332: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-09 15:02:53 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:34080: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-09 15:03:30 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:41532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2026-01-09 15:09:35 dovecot_login authenticator failed for H=(173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:50611: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.176
country_id: 3865483
description:
Jan  9 15:15:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=181.118.183.176, lip=66.85.158.91, TLS, session=<9NgXYvFH1JW1drew>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.215
country_id: 1269750
description:
Jan  9 15:16:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.70.126.215, lip=66.85.158.91, TLS, session=<CU1nY/FHN9BnRn7X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-09 15:17:08 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:56040: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.208
country_id: 1733045
description:
2026-01-09 15:16:16 dovecot_login authenticator failed for H=([49.124.149.208]) [49.124.149.208]:56052: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 15:16:37 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:8971: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-09 15:17:36 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:38080: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 15:17:54 dovecot_plain authenticator failed for H=(phadia) [38.248.111.238]:40817: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-09 15:22:31 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:35508: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-09 15:22:12 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:56222: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.163.102.126
country_id: 3469034
description:
Jan  9 15:24:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=164.163.102.126, lip=66.85.158.91, TLS, session=<do4jgvFHBquko2Z+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.243.92.96
country_id: 2510769
description:
Jan  9 15:24:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.243.92.96, lip=66.85.158.91, TLS, session=<8YtIg/FHSZS581xg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.156.109.106
country_id: 1880251
description:
Jan  9 15:27:24 host2 sshd[1616675]: Disconnected from invalid user ubuntu 43.156.109.106 port 36408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.109.106
country_id: 1880251
description:
Jan  9 15:28:30 host2 sshd[1617438]: Disconnected from invalid user test 43.156.109.106 port 59602 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.125
country_id: 798544
description:
Jan  9 15:31:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=91.246.208.125, lip=66.85.158.91, TLS, session=<0xp0nPFHBNJb9tB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.57
country_id: 732800
description:
Jan  9 15:32:12 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.215.57, lip=66.85.158.91, TLS, session=<0HWGnfFHJLm5/9c5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.32.153
country_id: 1819730
description:
Jan  9 15:35:36 host2 sshd[1622969]: Disconnected from invalid user user1 43.154.32.153 port 45014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-09 15:35:55 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:41296: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-09 15:36:13 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:44479: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-09 15:37:08 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:55050: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan  9 15:37:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.91, session=<jS2FsPFH9LpV2ZUL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 15:38:36 host2 sshd[1625308]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.4
country_id: 798549
description:
Jan  9 15:38:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.4, lip=66.85.158.92, session=<3QfbtfFHmtZV2ZUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:42:10 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<dGclwvFHSJIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:44:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<7EX8yfFHxIkDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-09 15:45:01 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:65338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:45:14 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jXYhzfFHmuEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2026-01-09 15:45:14 dovecot_login authenticator failed for H=6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:41942: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-09 15:45:35 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (patomytous) [73.213.236.66]:59346: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:46:19 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<OSP60PFHNL4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:47:11 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<h5sf1PFH1s8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:48:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<hJKl1/FHCqgDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:49:28 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<KcZK3PFHDKIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:50:25 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<o9Wy3/FHQNsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:51:25 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<TcI64/FHBrUDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 15:52:57 host2 sshd[1646313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  9 15:52:18 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<untm5vFHYJIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-09 15:57:07 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:33648: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Jan  9 15:57:17 host2 sshd[1652009]: Disconnected from invalid user user 103.88.76.27 port 51724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 15:57:47 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:49666: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-09 15:58:07 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:34865: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 15:58:24 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:44560: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2026-01-09 15:59:03 dovecot_plain authenticator failed for H=(piumiabely) [62.73.121.209]:57250: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Jan  9 15:59:16 host2 sshd[1653608]: Disconnected from invalid user test 103.88.76.27 port 60538 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.147
country_id: 2635167
description:
Jan  9 16:01:15 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.147, lip=66.85.158.92, TLS, session=<cfhuBvJHX4S594mT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-09 16:06:08 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:46231: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-09 16:06:23 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:41124: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-09 16:11:18 dovecot_plain authenticator failed for H=(dentled) [50.202.197.108]:56282: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 16:15:03 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:49300: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-09 16:15:06 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:47136: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2026-01-09 16:14:43 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [187.58.66.231]:40365: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-09 16:15:15 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:50410: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-09 16:28:55 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:36016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2026-01-09 16:29:24 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:42937: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.25
country_id: 798549
description:
Jan  9 16:29:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.25, lip=66.85.158.92, session=<vXw3bPJH7K9V2ZUZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-09 16:30:18 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:60888: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  9 16:30:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.92, TLS: Connection closed, session=<TY/zb/JHmKhV2ZUP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-09 16:30:57 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:50225: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 16:31:09 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:62653: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.166.126
country_id: 1269750
description:
2026-01-09 16:34:20 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [152.59.166.126]:53173: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-09 16:39:58 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:38550: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-09 16:39:39 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62479: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-09 16:43:36 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (spenes) [174.161.27.82]:35984: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2026-01-09 16:43:42 dovecot_login authenticator failed for H=([196.188.187.85]) [196.188.187.85]:59474: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-01-09 16:44:07 dovecot_login authenticator failed for H=([13.68.214.34]) [13.68.214.34]:55064: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-09 16:48:29 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:38021: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-09 16:49:42 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:41682: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-09 16:50:34 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:35493: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:53:55 host2 sshd[1698620]: Disconnected from invalid user user 155.248.164.42 port 53904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.162
country_id: 1269750
description:
2026-01-09 16:54:13 dovecot_login authenticator failed for H=(033.162.18.125.dhcp.anaronline.net) [125.19.248.162]:51052: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-09 16:54:24 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:36992: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-09 16:54:43 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:42780: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-09 16:54:55 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:47270: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  9 16:54:11 host2 sshd[1698881]: Disconnected from invalid user user 122.176.122.24 port 51276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:55:09 host2 sshd[1699907]: Disconnected from invalid user user 155.248.164.42 port 43374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:58:01 host2 sshd[1702253]: Disconnected from invalid user test 155.248.164.42 port 51298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Jan  9 16:58:33 host2 sshd[1702781]: Disconnected from invalid user test 155.248.164.42 port 48960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-09 16:58:47 dovecot_plain authenticator failed for H=(voltunes) [154.146.240.123]:57114: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-09 17:02:13 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:54500: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2026-01-09 17:03:00 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:43190: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-09 17:06:05 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:60196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-09 17:06:23 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:31827: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-09 17:10:22 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:33190: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.245.14
country_id: 2921044
description:
Jan  9 17:12:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.245.14, lip=66.85.158.92, session=<x0Z1BfNHbtto+PUO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.244.226
country_id: 2921044
description:
Jan  9 17:12:33 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.244.226, lip=66.85.158.92, session=<4CJlBfNHBeYuZfTi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 17:13:17 host2 pure-ftpd[1712680]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-09 17:19:26 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:46430: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-09 17:19:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:56394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  9 17:17:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<Ay0bF/NHWNdChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 17:18:45 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:39806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:27:12 host2 sshd[1723263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.7
country_id: 2589581
description:
2026-01-09 17:32:18 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.7]:27926: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.90
country_id: 3469034
description:
Jan  9 17:37:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.80.41.90, lip=66.85.158.91, TLS, session=<D47jW/NHatyqUCla>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-09 17:36:23 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:44982: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-09 17:37:23 dovecot_plain authenticator failed for H=(witormony) [65.20.184.80]:39711: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.1
country_id: 3175395
description:
Jan  9 17:37:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.15.170.1, lip=66.85.158.91, TLS, session=<ybNtXfNHkZa5D6oB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  9 17:40:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XPHOZ/NHOf7CpRCi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:41:37 host2 sshd[1734407]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-09 17:42:48 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:39298: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-09 17:43:12 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:39544: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-09 17:43:49 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:55124: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-09 17:45:49 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:44041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-09 17:46:06 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:60966: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-09 17:55:10 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (recinspid) [68.52.119.193]:58028: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2026-01-09 17:59:56 dovecot_login authenticator failed for H=([103.57.224.221]) [103.57.224.221]:44411: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:00:56 host2 sshd[1750779]: Disconnected from invalid user ubuntu 192.3.179.41 port 33114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.124
country_id: 3996063
description:
2026-01-09 18:02:06 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.124]:37796: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:02:31 host2 sshd[1751888]: Disconnected from invalid user admin 192.3.179.41 port 49968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 18:03:06 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (copic) [174.166.153.20]:44588: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  9 18:03:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jgnfuvNHuf/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-09 18:05:48 dovecot_login authenticator failed for H=([182.95.2.9]) [182.78.67.22]:37828: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-09 18:06:02 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:55370: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-09 18:06:09 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:58824: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  9 18:05:16 host2 sshd[1754278]: Disconnected from invalid user ubuntu 4.213.160.153 port 60426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-09 18:06:28 dovecot_plain authenticator failed for H=(ightner) [176.113.155.132]:38103: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 18:06:13 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:33390: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-09 18:11:47 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:42344: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-09 18:11:22 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:55244: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-09 18:16:29 dovecot_plain authenticator failed for H=(ratiocal) [80.227.102.242]:58963: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:24:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<t3L6B/RH+g6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:28:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZdxrFPRHSkyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.54
country_id: 390903
description:
2026-01-09 18:28:06 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.54]:4818: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:28:18 host2 sshd[1776146]: Disconnected from invalid user user 45.78.201.248 port 39506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 18:28:31 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (petemet) [73.213.237.28]:59886: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.209
country_id: 798544
description:
Jan  9 18:32:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=46.174.73.209, lip=66.85.158.91, TLS, session=<mpLHI/RHStEurknR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.106.156
country_id: 3686110
description:
Jan  9 18:32:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.106.156, lip=66.85.158.91, TLS, session=<ohCrIvRHaLK6YGqc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-09 18:35:31 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:42707: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-09 18:35:52 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:49676: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:36:49 host2 sshd[1783586]: Disconnected from invalid user ubuntu 45.78.201.248 port 53424 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.128.229
country_id: 2921044
description:
Jan  9 18:36:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.128.229, lip=66.85.158.92, session=<vgvfMvRHVUYuZYDl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:38:11 host2 sshd[1784769]: Disconnected from invalid user admin 45.78.201.248 port 55098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-09 18:44:56 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:58169: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.177
country_id: 3175395
description:
Jan  9 18:44:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.15.171.177, lip=66.85.158.91, TLS, session=<V0phTvRHDq+5D6ux>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-09 18:45:12 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:44052: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.62
country_id: 690791
description:
Jan  9 18:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.11.62, lip=66.85.158.91, TLS, session=<0KnyT/RHAJSwZws+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.146.235
country_id: 2921044
description:
Jan  9 18:49:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.146.235, lip=66.85.158.92, session=<92fBXvRHBn2l45Lr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2026-01-09 18:51:19 +0530] info [cpaneld] 46.105.235.55 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.27
country_id: 3625428
description:
2026-01-09 18:52:26 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.27]:17617: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-09 18:53:36 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:41708: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 18:53:56 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:52040: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-09 18:55:20 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:38408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-09 18:54:50 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:33276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.52
country_id: 3175395
description:
Jan  9 18:59:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.15.170.52, lip=66.85.158.91, TLS, session=<rEQlgvRHg9i5D6o0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.24
country_id: 3865483
description:
Jan  9 18:59:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=186.64.95.24, lip=66.85.158.91, TLS, session=<Ce41gvRHCMi6QF8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-09 18:59:09 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (coning) [73.197.194.98]:43340: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.210
country_id: 3057568
description:
Jan  9 18:59:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=31.134.98.210, lip=66.85.158.91, TLS, session=<bllGg/RHy84fhmLS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.101
country_id: 3469034
description:
Jan  9 18:59:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=187.120.72.101, lip=66.85.158.91, TLS, session=<udaQg/RHXb67eEhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-09 19:01:34 dovecot_plain authenticator failed for H=(unprobast) [85.96.189.27]:34798: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:02:59 host2 sshd[1809185]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:03:29 host2 sshd[1809778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:06:00 host2 sshd[1810838]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-01-09 19:06:09 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:46494: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-09 19:05:31 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:59450: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-09 19:05:55 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:52920: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:06:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<4pvunPRHQrMvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-09 19:06:35 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:52523: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:08:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ClZTpPRHhjii8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.41
country_id: 2921044
description:
Jan  9 19:09:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=138.68.70.41, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eOrFqPRHQJyKREYp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 19:10:27 host2 sshd[1817937]: Disconnected from invalid user user 2.57.121.25 port 35923 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:10:34 host2 sshd[1817906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:09 host2 sshd[1819526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:12:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<0oKNsPRHSt8vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:12:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qBMNsfRHJiCi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:33 host2 sshd[1819981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2026-01-09 19:34:01 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:49767: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-09 19:34:10 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:51495: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-09 19:34:19 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:57586: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-09 19:34:27 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:60518: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Jan  9 19:35:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<KF2lA/VHGKEiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-09 19:34:53 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:41970: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-09 19:36:14 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:53871: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-09 19:36:54 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:55752: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<gpuhF/VHxKovWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.192.41
country_id: 3865483
description:
Jan  9 19:44:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.192.41, lip=66.85.158.91, TLS, session=<48bXJPVHEN26YMAp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 19:44:58 dovecot_plain authenticator failed for H=(herobtrows) [102.53.15.180]:46885: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.8
country_id: 3865483
description:
Jan  9 19:45:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.8, lip=66.85.158.91, TLS, session=<VSIaJvVHrsuzAPsI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.49.2
country_id: 6252001
description:
Jan  9 19:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.106.49.2, lip=66.85.158.92, session=<sBWHJ/VHmM8UajEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:46:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<nSJoKvVHaoovWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 19:47:18 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:40476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.40
country_id: 953987
description:
Jan  9 19:47:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.129.51.40, lip=66.85.158.91, TLS, session=<WxW0LfVHGtJmgTMo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 19:46:39 host2 pure-ftpd[1847803]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Jan  9 19:47:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<RCbyLvVH45NBFI/Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2026-01-09 19:48:10 dovecot_login authenticator failed for H=([183.171.7.171]) [183.171.7.171]:46430: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan  9 19:49:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6atVN/VHWFSGelvE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:52:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZGmyQPVHYGWi8Jp9>


