# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.6.215.53
country_id: 3469034
description:
Jan 11 15:27:08 host2 sshd[259281]: Disconnected from invalid user botuser 69.6.215.53 port 43470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan 11 15:28:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<0gb3zRlIdLnE+2YS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.6.215.53
country_id: 3469034
description:
Jan 11 15:28:22 host2 sshd[260415]: Disconnected from invalid user test 69.6.215.53 port 54358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 15:29:57 host2 sshd[261700]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-11 15:32:59 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (uvened) [68.52.119.193]:54588: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:35:53 host2 sshd[267175]: Disconnected from invalid user user1 122.155.0.205 port 19432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:36:53 host2 sshd[268338]: Disconnected from invalid user test 128.199.157.145 port 60248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.46.251
country_id: 6252001
description:
Jan 11 15:36:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.46.251, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jXg76BlIgNWfWS77>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.113.48.116
country_id: 3175395
description:
2026-01-11 15:36:08 dovecot_plain authenticator failed for H=mob-109-113-48-116.net.vodafone.it (JKJEX) [109.113.48.116]:56461: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Jan 11 15:37:43 host2 sshd[269166]: Disconnected from invalid user teamspeak 45.78.224.109 port 51242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.134.182
country_id: 1819730
description:
Jan 11 15:37:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=152.32.134.182, lip=66.85.158.91, session=<piqO7hlI7m2YIIa2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:37:33 host2 sshd[268975]: Disconnected from invalid user postgres 128.199.157.145 port 43206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:37:35 host2 sshd[269000]: Disconnected from invalid user vpn 122.155.0.205 port 57949 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:38:50 host2 sshd[270428]: Disconnected from invalid user ftpuser 122.155.0.205 port 45352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:38:14 host2 sshd[269732]: Disconnected from invalid user ubuntu 122.155.0.205 port 61441 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-01-11 15:39:28 1vesNz-000000018VS-2C4x <= wordpress@venee.lk U=veneelk P=local S=36245 id=bZPsO9vVq4FNFpTKxSrGhsul0KXzCBAKLbMSaw1CA@coatrent.venee.lk T="Failed login by IP 159.89.203.80 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:39:57 host2 sshd[271538]: Disconnected from invalid user test 54.38.52.18 port 56410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:39:37 host2 sshd[271285]: Disconnected from invalid user user1 128.199.157.145 port 48564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-11 15:40:27 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:48802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Jan 11 15:40:51 host2 sshd[272589]: Disconnected from invalid user admin 78.187.21.105 port 39636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:40:31 host2 sshd[272311]: Disconnected from invalid user deploy 54.38.52.18 port 44004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-11 15:40:41 dovecot_login authenticator failed for H=(syn-075-183-106-192.res.spectrum.com) [75.183.106.192]:39935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.237
country_id: 6252001
description:
Jan 11 15:40:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.237, lip=66.85.158.91, session=<cfXj+BlIKu2H7X3t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:41:37 host2 sshd[273155]: Disconnected from invalid user teamspeak 54.38.52.18 port 44818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-11 15:41:39 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:39230: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-11 15:41:57 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:56243: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-11 15:41:12 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:48768: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Jan 11 15:41:25 host2 sshd[273016]: Disconnected from invalid user steam 192.210.233.234 port 55784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Jan 11 15:42:23 host2 sshd[273712]: Disconnected from invalid user frappe 78.187.21.105 port 36698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Jan 11 15:44:39 host2 sshd[275653]: Disconnected from invalid user admin 45.78.224.109 port 57366 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 15:45:15 host2 sshd[276861]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.147
country_id: 2186224
description:
2026-01-11 15:45:12 dovecot_login authenticator failed for H=([121.73.162.147]) [121.73.162.147]:38798: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.225.60
country_id: 6252001
description:
Jan 11 15:46:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.174.225.60, lip=66.85.158.92, session=<S7F7DhpIUOOsruE8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan 11 15:48:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<i/guFRpI4oXE+2YR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.144.47.94
country_id: 6252001
description:
Jan 11 15:48:52 host2 sshd[280315]: Disconnected from invalid user test 18.144.47.94 port 42716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Jan 11 15:49:47 host2 sshd[281051]: Disconnected from invalid user user 41.33.91.226 port 57954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.18.55.118
country_id: 1269750
description:
Jan 11 15:49:56 host2 sshd[281193]: Disconnected from invalid user test 119.18.55.118 port 45384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.91.226
country_id: 357994
description:
Jan 11 15:50:22 host2 sshd[281976]: Disconnected from invalid user claude 41.33.91.226 port 42138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.144.47.94
country_id: 6252001
description:
Jan 11 15:50:42 host2 sshd[282296]: Disconnected from invalid user user 18.144.47.94 port 40382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan 11 15:51:47 host2 sshd[283417]: Disconnected from invalid user steam 103.179.57.150 port 48836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.18.55.118
country_id: 1269750
description:
Jan 11 15:52:23 host2 sshd[284014]: Disconnected from invalid user user2 119.18.55.118 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 15:52:51 host2 sshd[284445]: Disconnected from invalid user user 128.1.38.64 port 57502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2026-01-11 15:54:52 dovecot_login authenticator failed for H=(45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:43940: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-11 15:55:29 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:50956: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-01-11 15:55:53 dovecot_login authenticator failed for H=([46.210.95.88]) [46.210.95.88]:37266: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 11 15:56:22 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<+B2eMBpIlLCLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:56:32 host2 sshd[289136]: Disconnected from invalid user postgres 45.232.73.84 port 59042 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan 11 15:57:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.92, session=<d4r1MhpIzOxV2ZUL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 15:57:05 host2 sshd[289748]: Disconnected from invalid user testuser 119.92.70.82 port 52456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 15:58:23 host2 sshd[290982]: Disconnected from invalid user testuser 119.92.70.82 port 43876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:58:34 host2 sshd[291110]: Disconnected from invalid user secret 45.232.73.84 port 55540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:59:18 host2 sshd[291637]: Disconnected from invalid user testuser 45.232.73.84 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:00:46 host2 sshd[293253]: Disconnected from invalid user secret 57.128.218.144 port 56626 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.34
country_id: 1819730
description:
Jan 11 16:01:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=45.142.154.34, lip=66.85.158.92, session=<wKhOQRpImKktjpoi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 16:01:49 host2 sshd[294294]: Disconnected from invalid user claude 119.92.70.82 port 55166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:01:55 host2 sshd[294364]: Disconnected from invalid user testuser 57.128.218.144 port 40848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:02:03 host2 sshd[294450]: Disconnected from invalid user testuser 35.216.63.127 port 43654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-11 16:02:37 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:44880: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:02:43 host2 sshd[295063]: Disconnected from invalid user admin 35.216.63.127 port 61840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2026-01-11 16:02:54 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:59834: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:02:58 host2 sshd[295240]: Disconnected from invalid user ftpuser 57.128.218.144 port 37238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:03:58 host2 sshd[296114]: Disconnected from invalid user claude 57.128.218.144 port 53170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-11 16:03:13 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:45643: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:03:22 host2 sshd[295708]: Disconnected from invalid user test1 35.216.63.127 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:03:32 host2 sshd[295804]: Disconnected from invalid user secret 128.1.38.64 port 38136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:04:22 host2 sshd[296465]: Disconnected from invalid user user 128.1.38.64 port 44200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 16:05:38 dovecot_plain authenticator failed for H=(tauccle) [65.20.160.107]:58681: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-11 16:06:17 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:35480: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-11 16:06:26 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:35132: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:08:54 host2 sshd[300658]: Disconnected from invalid user admin 128.1.38.64 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-01-11 16:08:55 dovecot_login authenticator failed for H=([103.250.160.76]) [103.250.160.76]:40008: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-11 16:09:28 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:49574: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-11 16:09:42 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:24332: 535 Incorrect authentication data (set_id=abuse@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-01-11 16:10:11 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:36492: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-11 16:10:35 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:60872: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2026-01-11 16:10:46 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:57666: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.25
country_id: 798549
description:
Jan 11 16:14:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.25, lip=66.85.158.92, session=<KBbccBpIeN1V2ZUZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-11 16:18:52 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:52578: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-11 16:19:08 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:58090: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-11 16:20:51 dovecot_plain authenticator failed for H=(heene) [154.144.243.93]:58358: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 16:24:56 host2 sshd[316188]: Disconnected from invalid user admin 2.57.121.112 port 40600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 16:27:25 host2 sshd[318239]: Disconnected from invalid user admin 2.57.121.112 port 50414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:34:10 host2 sshd[324976]: Disconnected from invalid user test 190.143.101.69 port 51118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Jan 11 16:34:31 host2 sshd[325340]: Disconnected from invalid user secret 103.213.238.91 port 46664 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:36:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<ZpJ6vhpIJsUDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:37:46 host2 sshd[328877]: Disconnected from invalid user claude 190.143.101.69 port 57022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:38:10 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<3sYYxhpI7qoDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:39:00 host2 sshd[330050]: Disconnected from invalid user testuser 190.143.101.69 port 53256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:39:32 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<HigCyxpILIMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:40:35 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<jBe/zhpIAooDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:41:07 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<dvqs0BpIOLwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:41:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<4tmn0BpIJrwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:42:43 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Ku9i1hpIUukDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:43:27 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<6vAH2RpIytkDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 16:44:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<wRTz3RpIDfwpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-11 16:44:13 dovecot_plain authenticator failed for H=(puglated) [65.20.250.163]:47166: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-11 16:44:17 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (warlene) [73.176.157.57]:52800: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:44:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ACj83RpIbNUDjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:06:53 host2 pure-ftpd[360472]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:08:00 host2 sshd[361448]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:07:26 host2 pure-ftpd[360978]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:07:27 host2 pure-ftpd[360997]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:08:09 host2 pure-ftpd[362189]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:08:09 host2 pure-ftpd[362203]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:09:07 host2 pure-ftpd[364170]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:09:07 host2 pure-ftpd[364163]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-01-11 17:11:23 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:59456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:14:52 host2 sshd[372084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-11 17:15:41 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (paspistis) [73.68.220.15]:47048: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:30:16 host2 sshd[387647]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-11 17:33:41 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (endereae) [73.13.220.220]:41096: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2026-01-11 17:33:41 dovecot_plain authenticator failed for H=cm-72-241-202-104.buckeyecom.net (ponnoccal) [72.241.202.104]:59866: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-11 17:35:39 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:52164: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-11 17:35:50 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (afting) [67.172.54.29]:53996: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-01-11 17:35:51 dovecot_plain authenticator failed for H=(kneigna) [46.35.178.104]:53318: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2026-01-11 17:36:11 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [121.242.112.200]:57464: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-11 17:36:37 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:43211: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-11 17:37:43 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:39416: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-01-11 17:38:03 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:42334: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-11 17:41:32 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (darac) [73.161.96.107]:37608: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 9.234.8.54
country_id: 6252001
description:
Jan 11 17:43:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=9.234.8.54, lip=66.85.158.91, session=<QgdfrxtILJ8J6gg2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 17:48:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<zBkuwBtIkOW5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-11 17:49:55 dovecot_plain authenticator failed for H=(undcal) [76.190.155.43]:35424: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2026-01-11 17:50:09 dovecot_login authenticator failed for H=([49.124.152.153]) [49.124.152.153]:47370: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-11 17:50:43 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:35952: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-11 17:51:44 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:41124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-01-11 17:53:15 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:36147: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.68.63
country_id: 6252001
description:
Jan 11 17:55:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=146.190.68.63, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Pczw2BtIxIySvkQ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.55.99.64
country_id: 6252001
description:
Jan 11 17:55:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.55.99.64, lip=66.85.158.92, session=<NDhu3BtITOIUN2NA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 17:57:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:29888: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-11 17:57:15 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (foriving) [73.145.107.251]:49764: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.176.93
country_id: 2921044
description:
Jan 11 17:57:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.176.93, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7KqI4RtIS+SnrLBd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-11 17:57:34 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:53762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.136.12
country_id: 2921044
description:
Jan 11 17:58:01 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.99.136.12, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V3Wo4xtIquGnY4gM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-11 17:57:18 dovecot_plain authenticator failed for H=(muffer) [24.105.248.218]:52292: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-11 17:57:27 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:53667: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-11 17:57:44 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52085: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 17:58:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<0Lhw5RtIMpa5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-11 17:58:36 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (samices) [174.166.153.20]:41922: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 17:59:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<j78/6htITNC5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 17:59:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<fWT36RtIdsG5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-11 18:02:13 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45114: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-11 18:02:23 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:34853: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 18:02:32 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<Q9Gu8xtIEOS5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-11 18:02:33 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:35628: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-11 18:03:31 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:46692: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 18:10:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<XgvzERxI2ru5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.67
country_id: 933860
description:
Jan 11 18:13:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.216.209.67, lip=66.85.158.91, TLS, session=<xJvdGhxIrYsp2NFD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.203
country_id: 690791
description:
Jan 11 18:14:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=194.44.140.203, lip=66.85.158.91, TLS, session=<aGgaHBxI+w3CLIzL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 18:14:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<H2oAHRxIgJS5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-11 18:14:41 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:49002: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2026-01-11 18:14:51 dovecot_login authenticator failed for H=([157.20.228.20]) [157.20.228.20]:33144: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-01-11 18:16:37 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee [85.29.246.199]:44442: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-11 18:16:56 dovecot_login authenticator failed for H=([122.169.40.221]) [122.169.40.221]:42144: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 18:17:52 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aming) [87.103.126.54]:60729: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-11 18:19:11 dovecot_plain authenticator failed for H=(forrento) [185.209.108.42]:49498: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-11 18:22:20 dovecot_plain authenticator failed for H=(goyis) [65.20.184.80]:57499: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-11 18:30:28 dovecot_plain authenticator failed for H=(mangratume) [102.53.15.17]:54034: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.227.136
country_id: 2921044
description:
Jan 11 18:34:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.92.227.136, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<No7XZRxIN0GkXOOI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Jan 11 18:34:59 host2 sshd[450874]: Disconnected from invalid user minecraft 152.32.189.21 port 44638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.244.15
country_id: 2921044
description:
Jan 11 18:35:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.92.244.15, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SbIMaBxIVqmkXPQP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-11 18:35:27 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:37554: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-11 18:35:41 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:50584: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.73
country_id: 6252001
description:
2026-01-11 18:37:46 dovecot_login authenticator failed for H=(dfw-206-109-56-73.ip4.99.network) [206.109.56.73]:43092: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-11 18:38:45 dovecot_login authenticator failed for H=(14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:56117: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.170.42
country_id: 1819730
description:
Jan 11 18:42:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=152.32.170.42, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MemCgxxIev+YIKoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2026-01-11 18:49:50 dovecot_login authenticator failed for H=([177.236.146.242]) [177.236.146.242]:36365: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-11 18:50:38 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:43472: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 18:50:52 host2 sshd[466942]: Disconnected from invalid user admin 2.57.121.112 port 50959 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 18:53:53 host2 sshd[469626]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-11 18:56:03 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:37302: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 18:56:54 host2 sshd[472677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-11 18:56:19 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:51234: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.83
country_id: 3469034
description:
Jan 11 18:59:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=191.240.96.83, lip=66.85.158.91, TLS, session=<0ir3vRxINty/8GBT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.24.188
country_id: 933860
description:
Jan 11 18:59:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=83.143.24.188, lip=66.85.158.91, TLS, session=<e5VDvxxIqIlTjxi8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 19:00:21 host2 sshd[475659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.71
country_id: 3175395
description:
Jan 11 19:05:49 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.47.136.71, lip=66.85.158.91, TLS, session=<A2sr1RxI99C5L4hH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.16.88.108
country_id: 1269750
description:
Jan 11 19:05:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=210.16.88.108, lip=66.85.158.91, TLS, session=<ATl50xxI2eXSEFhs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.138
country_id: 1733045
description:
2026-01-11 19:05:49 dovecot_login authenticator failed for H=([183.171.4.138]) [183.171.4.138]:53906: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.157.128.165
country_id: 1861060
description:
2026-01-11 19:06:13 dovecot_login authenticator failed for H=s128165.ppp.asahi-net.or.jp [220.157.128.165]:52295: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-11 19:14:01 dovecot_plain authenticator failed for H=(goory) [64.72.74.162]:46522: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 19:15:53 host2 sshd[491616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.241.142.175
country_id: 6252001
description:
Jan 11 19:27:35 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.241.142.175, lip=66.85.158.92, TLS, session=<XJ4CJB1IQqXA8Y6v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-01-11 19:33:02 dovecot_plain authenticator failed for H=(muslodonic) [154.144.255.208]:59430: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 19:33:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lomac) [87.103.126.54]:23622: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 19:37:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<8y+wSB1IiNgpGegH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Jan 11 19:41:51 host2 sshd[515345]: Disconnected from invalid user test 177.53.215.134 port 48210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan 11 19:42:28 host2 sshd[515844]: Disconnected from invalid user secret 177.53.215.134 port 59306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-11 19:45:47 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (coema) [73.196.144.25]:41264: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.208
country_id: 1643084
description:
Jan 11 19:46:43 host2 sshd[521661]: Disconnected from invalid user user2 103.172.205.208 port 57902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:48:50 host2 sshd[525038]: Disconnected from invalid user testuser 189.47.10.10 port 33824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:51:22 host2 sshd[529088]: Disconnected from invalid user claude 5.182.83.231 port 37538 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:52:19 host2 sshd[529816]: Disconnected from invalid user admin 5.182.83.231 port 46036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:53:13 host2 sshd[530460]: Disconnected from invalid user ubuntu 5.182.83.231 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:54:35 host2 sshd[531818]: Disconnected from invalid user secret 189.47.10.10 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:55:34 host2 sshd[532988]: Disconnected from invalid user user 189.47.10.10 port 52908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:56:31 host2 sshd[533789]: Disconnected from invalid user frappe 189.47.10.10 port 50840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 20:05:58 host2 sshd[543779]: Disconnected from invalid user admin 2.57.121.112 port 53069 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:11:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<A+hFvx1IMtui2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:11:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<i3KYwh1IeO6i2JZ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 20:13:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (laystron) [87.103.126.54]:51447: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:17:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS, session=<Vk/O1x1Iuv2i2JZ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2026-01-11 20:18:58 dovecot_login authenticator failed for H=([182.79.126.100]) [182.95.57.194]:45644: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2026-01-11 20:18:24 dovecot_login authenticator failed for H=apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:47235: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-11 20:19:48 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:43072: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-11 20:20:05 dovecot_login authenticator failed for H=(93.75.245.49.unknown.m1.com.sg) [49.245.75.93]:43616: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.12
country_id: 1733045
description:
2026-01-11 20:20:20 dovecot_login authenticator failed for H=([49.124.152.12]) [49.124.152.12]:53322: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.81.8
country_id: 3469034
description:
2026-01-11 20:20:22 dovecot_login authenticator failed for H=([45.186.81.8]) [45.186.81.8]:56803: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:21:57 host2 sshd[559449]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.246
country_id: 690791
description:
Jan 11 20:27:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=176.103.5.246, lip=66.85.158.91, TLS, session=<KwVg+R1IA8ywZwX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.186
country_id: 3175395
description:
Jan 11 20:27:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.208.106.186, lip=66.85.158.91, TLS, session=<MSeD+h1IZMm50Gq6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:28:54 host2 sshd[565967]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 20:30:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (scophy) [87.103.126.54]:40039: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.152
country_id: 3469034
description:
Jan 11 20:34:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.7.187.152, lip=66.85.158.91, TLS, session=<lovTEB5IULctB7uY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.99
country_id: 3469034
description:
Jan 11 20:34:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=190.89.137.99, lip=66.85.158.91, TLS, session=<JsoMEh5IMtq+WYlj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan 11 20:40:44 host2 pure-ftpd[578037]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-11 20:40:27 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (unced) [76.145.10.140]:56420: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 11 20:42:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<v5exLx5I/OCSvhb3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:44:24 host2 sshd[581820]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.121.52
country_id: 2635167
description:
Jan 11 20:51:56 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=165.22.121.52, lip=66.85.158.91, TLS, session=<672hUR5IMI2lFnk0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-11 20:58:45 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:50942: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-11 20:59:11 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:39212: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2026-01-11 21:00:50 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:59354: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-11 21:01:37 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:47344: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.44
country_id: 1819730
description:
Jan 11 21:03:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=45.142.154.44, lip=66.85.158.92, session=<ACzxex5I9Ngtjpos>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:05:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<mxgPgx5IONS5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-11 21:06:40 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:37451: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-11 21:07:05 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:48587: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:10:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<iyLlkh5IEtW5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 21:11:37 host2 sshd[609779]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.236
country_id: 953987
description:
Jan 11 21:12:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.56.236, lip=66.85.158.91, TLS, session=<6/3Kmh5Iq7hmgTjs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.6.155
country_id: 953987
description:
Jan 11 21:13:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=102.66.6.155, lip=66.85.158.91, TLS, session=<f5ggnB5Ik9FmQgab>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 21:17:41 host2 sshd[616224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan 11 21:17:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<23E/rh5Iot3E+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 21:20:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<hd0xtx5Iori5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 21:21:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<GcbFux5Iquy5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2026-01-11 21:22:43 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:46270: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-01-11 21:23:18 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:36468: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 21:24:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<CdZExx5IINa5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 21:25:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<ELPsxx5IAIa5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-01-11 21:25:38 dovecot_login authenticator failed for H=([50.212.27.146]) [50.212.27.150]:45656: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 21:26:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<sfHCyx5IgMu5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.228.235.21
country_id: 3508796
description:
2026-01-11 21:26:45 dovecot_login authenticator failed for H=([168.228.235.21]) [168.228.235.21]:59214: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-11 21:28:07 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:60435: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-01-11 21:28:35 dovecot_login authenticator failed for H=([65.20.202.4]) [65.20.202.4]:39454: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 21:29:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<afX21x5IyoK5XVku>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.182.211
country_id: 2921044
description:
Jan 11 21:31:26 host2 pure-ftpd[630910]: (?@138.197.182.211) [INFO] New connection from 138.197.182.211


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 21:33:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<s2Xl5x5ItLi5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-11 21:35:50 dovecot_plain authenticator failed for H=(etitchings) [154.144.243.93]:52852: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-11 21:36:10 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:39303: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 21:36:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<uEkv8h5IfKm5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 21:38:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<JkO9+B5IMIu5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-11 21:39:49 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:43266: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-11 21:40:20 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49821: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 21:41:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<HPgmAh9IuJq5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:41:22 host2 sshd[640378]: Disconnected from invalid user odoo 23.161.168.8 port 58810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan 11 21:41:53 host2 sshd[640902]: Disconnected from invalid user ec2-user 34.142.110.144 port 41196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.214.11.146
country_id: 2921044
description:
Jan 11 21:42:13 host2 sshd[641232]: Disconnected from invalid user odoo 95.214.11.146 port 60672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Jan 11 21:42:28 host2 sshd[641507]: Disconnected from invalid user developer 34.142.110.144 port 52390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-11 21:45:29 dovecot_plain authenticator failed for H=(stagic) [85.96.189.27]:50376: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:47:06 host2 sshd[646040]: Disconnected from invalid user sshadmin 23.161.168.8 port 57812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.214.11.146
country_id: 2921044
description:
Jan 11 21:47:31 host2 sshd[646417]: Disconnected from invalid user varnish 95.214.11.146 port 53808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:47:33 host2 sshd[646471]: Disconnected from invalid user ts1 23.161.168.8 port 43514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:47:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Ij0UFx9Itr25XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-11 21:59:03 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:57598: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.37
country_id: 3923057
description:
Jan 11 21:59:51 host2 sshd[672559]: Disconnected from invalid user git 190.181.27.37 port 35170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-11 21:59:16 dovecot_login authenticator failed for H=([46.212.118.138]) [46.212.118.138]:38536: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:00:42 host2 sshd[673432]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.37
country_id: 3923057
description:
Jan 11 22:00:31 host2 sshd[673483]: Disconnected from invalid user tester 190.181.27.37 port 40184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 22:02:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<S92GTh9IktW5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 22:03:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<4OPDUR9IPMK5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 22:03:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<Hty+Uh9IvNC5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 22:04:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<g7j5VR9Iyuu5XVkw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.198
country_id: 6252001
description:
Jan 11 22:05:29 host2 pure-ftpd[679194]: (?@205.210.31.198) [INFO] New connection from 205.210.31.198


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 22:07:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<UUA4Xx9IDpq5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-11 22:08:05 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:33874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 22:08:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<l0x/Yh9I2LC5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-11 22:08:37 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:33726: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.234
country_id: 2635167
description:
Jan 11 22:12:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.234, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hBk+cB9I89Ajy9Lq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:14:37 host2 sshd[689744]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-11 22:14:33 dovecot_plain authenticator failed for H=(unianthuto) [102.53.15.180]:47213: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 22:18:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<UtHshx9IRKi5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.234
country_id: 2635167
description:
Jan 11 22:19:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.234, lip=66.85.158.91, TLS, session=<mrekiR9IovYjy9Lq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 22:19:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<W2aPih9I8pG5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 22:19:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CG4zix9Ioqi5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 22:20:22 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<w4zQjR9IVOy5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 22:23:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (brallinain) [87.103.126.54]:14589: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 22:23:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<VL/jmR9Ig+UpGegH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:25:31 host2 sshd[701639]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-11 22:25:51 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:53308: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-11 22:26:11 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:50430: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 11 22:27:23 host2 pure-ftpd[703643]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-11 22:29:02 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:33612: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-11 22:29:33 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:46576: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:30:09 host2 sshd[706233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.145.158.145
country_id: 6252001
description:
Jan 11 22:30:20 host2 pure-ftpd[706438]: (?@54.145.158.145) [INFO] New connection from 54.145.158.145


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.120
country_id: 2635167
description:
Jan 11 22:31:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.120, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jMlhtR9IU52594l4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan 11 22:31:23 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.212, lip=66.85.158.92, TLS, session=<o+ZRtR9Iq7VX7LDU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.139
country_id: 2635167
description:
Jan 11 22:31:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ETxdtx9IIbC594mL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.143
country_id: 2635167
description:
Jan 11 22:32:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bpxYuR9Io+lX7LCP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.144
country_id: 2635167
description:
Jan 11 22:33:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ARpUux9IC7i594mQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Jan 11 22:33:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.128, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<amZPvR9IqcC594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.129
country_id: 2635167
description:
Jan 11 22:34:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.129, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lcZIvx9IPa6594mB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.132
country_id: 2635167
description:
Jan 11 22:34:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.132, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<EANGwR9I55e594mE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:35:41 host2 sshd[711734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.135
country_id: 2635167
description:
Jan 11 22:35:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.135, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XmVBwx9Id7BX7LCH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.126
country_id: 2635167
description:
Jan 11 22:35:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<f8I6xR9Ig9VX7LB+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Jan 11 22:36:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JalCxx9IT8BX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 22:39:03 dovecot_plain authenticator failed for H=(adoaterhal) [65.20.160.107]:32852: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:39:51 host2 sshd[715348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-01-11 22:39:45 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (denon) [76.16.7.82]:38343: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-11 22:43:59 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:56596: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-11 22:44:16 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:34544: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:49:22 host2 sshd[724725]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.226.42
country_id: 3469034
description:
Jan 11 22:52:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=168.0.226.42, lip=66.85.158.91, TLS, session=<tA89/h9IFraoAOIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.32
country_id: 690791
description:
Jan 11 22:52:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=194.44.140.32, lip=66.85.158.91, TLS, session=<1FBs/x9Ip7vCLIwg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.193
country_id: 6252001
description:
Jan 11 22:53:03 host2 pure-ftpd[728252]: (?@172.236.228.193) [INFO] New connection from 172.236.228.193


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.246.199.216
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.246.199.216: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.220.88.67
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.220.88.67: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.220.3.101
country_id: 226074
description:
Jan 11 22:59:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.220.3.101, lip=66.85.158.91, TLS, session=<s/rIGCBI0K0p3ANl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-11 22:59:33 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:46133: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.211.236.187
country_id: 3175395
description:
2026-01-11 22:59:36 dovecot_plain authenticator failed for H=([80.211.236.187]) [80.211.236.187]:49251: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.25.240.159
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.25.240.159: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.59.97.98
country_id: 2661886
description:
Jan 11 22:59:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<587hr>, method=PLAIN, rip=46.59.97.98, lip=66.85.158.91, TLS, session=<84rtGSBIRJUuO2Fi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-11 23:00:10 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:56406: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2026-01-11 23:00:20 dovecot_login authenticator failed for H=176-170-1-244.abo.bbox.fr [176.170.1.244]:46708: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-11 23:00:47 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48206: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-11 23:01:03 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:59942: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Jan 11 23:02:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=173.255.221.189, lip=66.85.158.92, session=<WyrVIiBIltGt/929>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.215
country_id: 6252001
description:
Jan 11 23:07:14 host2 pure-ftpd[743088]: (?@198.235.24.215) [INFO] New connection from 198.235.24.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 23:08:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (guyal) [87.103.126.54]:52065: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-11 23:09:19 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:46716: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-11 23:09:48 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:39918: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:12:44 host2 sshd[748145]: Disconnected from invalid user sshtest 79.32.190.134 port 60596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:13:24 host2 sshd[748896]: Disconnected from invalid user share 79.32.190.134 port 43570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:13:22 host2 sshd[748889]: Disconnected from invalid user deploytest 45.138.158.114 port 50398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:14:11 host2 sshd[749570]: Disconnected from invalid user debian 79.32.190.134 port 54784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 6252001
description:
Jan 11 23:16:18 host2 sshd[751711]: Disconnected from invalid user botuser1 154.219.125.194 port 50594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Jan 11 23:16:29 host2 sshd[751813]: Disconnected from invalid user newuser 197.225.146.23 port 34888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 11 23:16:39 host2 sshd[751917]: Disconnected from invalid user ftptest 208.69.84.112 port 33498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:17:16 host2 sshd[752707]: Disconnected from invalid user ftp-admin 45.138.158.114 port 46720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 11 23:17:09 host2 sshd[752570]: Disconnected from invalid user luis 208.69.84.112 port 60850 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 23:18:55 host2 sshd[754187]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:18:26 host2 sshd[753762]: Disconnected from invalid user support 45.138.158.114 port 54682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.203
country_id: 798544
description:
Jan 11 23:26:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=89.107.155.203, lip=66.85.158.91, TLS, session=<PDzmdyBIHbJZa5vL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.224
country_id: 1269750
description:
Jan 11 23:26:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=103.164.246.224, lip=66.85.158.91, TLS, session=<1kgReSBIoa1npPbg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-11 23:27:31 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:59665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-11 23:29:21 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:45967: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-11 23:29:40 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:58130: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.69
country_id: 6252001
description:
Jan 11 23:30:40 host2 pure-ftpd[766141]: (?@184.105.139.69) [INFO] New connection from 184.105.139.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 23:31:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chiandyned) [87.103.126.54]:50257: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:32:42 host2 sshd[767849]: Disconnected from invalid user botuser 120.28.109.188 port 54482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.125
country_id: 1269750
description:
Jan 11 23:33:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.104.127.125, lip=66.85.158.91, TLS, session=<Q5gCkiBIbLFnaH99>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.204.23.12
country_id: 6252001
description:
Jan 11 23:33:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<careers>, method=PLAIN, rip=67.204.23.12, lip=66.85.158.91, TLS, session=</qk2kyBIXZZDzBcM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:34:59 host2 sshd[769550]: Disconnected from invalid user odoo13 120.28.109.188 port 40146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-11 23:35:29 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:36106: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:35:33 host2 sshd[770351]: Disconnected from invalid user minecraft 120.28.109.188 port 39600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-11 23:35:52 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:44724: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-11 23:35:55 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:41050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:36:42 host2 sshd[771549]: Disconnected from invalid user bot1 120.28.109.188 port 33016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2026-01-11 23:36:12 dovecot_login authenticator failed for H=([162.186.17.150]) [162.186.17.150]:55432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2026-01-11 23:37:17 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (comed) [73.55.194.114]:54590: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-11 23:37:46 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:49544: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-11 23:39:57 dovecot_login authenticator failed for H=([24.104.225.201]) [24.104.225.201]:45168: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-11 23:39:27 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:37330: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.246.248.18
country_id: 1819730
description:
Jan 11 23:39:30 host2 sshd[774150]: Disconnected from invalid user cs 38.246.248.18 port 55506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-11 23:52:16 dovecot_plain authenticator failed for H=ool-457e901e.dyn.optonline.net (eptiousk) [69.126.144.30]:56880: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-11 23:52:40 dovecot_plain authenticator failed for H=(colized) [64.72.74.162]:57063: 535 Incorrect authentication data (set_id=info@systemtec.lk)


