# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.190.234.158
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 85.190.234.158 - topviewuser "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-08 07:58:37 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:37032: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.161.152
country_id: 298795
description:
2026-01-08 08:04:17 dovecot_login authenticator failed for H=([5.11.161.152]) [5.11.161.152]:53341: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:03:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5HY/PddHopkDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:04:41 host2 sshd[4188702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-08 08:04:26 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:47218: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:05:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PhlwQtdHYIUDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:06:07 host2 sshd[4190197]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:06:40 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<45ZbR9dHULQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:07:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VP2fS9dHpMkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2026-01-08 08:08:57 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:48133: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-08 08:09:31 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:37430: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 08:09:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<1BKkUddHkJsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.73
country_id: 6252001
description:
Jan  8 08:15:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.73, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KA1MZtdHQczN0h9J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.181.107.134
country_id: 2264397
description:
2026-01-08 08:16:57 dovecot_login authenticator failed for H=89-181-107-134.net.novis.pt [89.181.107.134]:58468: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-08 08:17:19 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:46550: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-08 08:18:34 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:34750: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-08 08:19:06 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (spoly) [75.74.211.27]:52117: 535 Incorrect authentication data (set_id=it@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2026-01-08 08:19:07 dovecot_login authenticator failed for H=([182.79.86.54]) [182.79.86.54]:57862: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 08:19:09 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (zinsh) [87.103.126.54]:65348: 535 Incorrect authentication data (set_id=it@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-08 08:19:24 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:53399: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.154
country_id: 6251999
description:
2026-01-08 08:20:57 dovecot_login authenticator failed for H=(ADMIN) [149.22.95.154]:59259: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-08 08:20:59 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:57856: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  8 08:21:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<iQYmfNdHekpChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-08 08:21:50 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53388: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 08:21:25 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:23452: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-08 08:21:25 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:41320: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.51.27
country_id: 1605651
description:
Jan  8 08:23:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.51.27, lip=66.85.158.91, session=<8Kt1gtdHONSlmjMb>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.51.27
country_id: 1605651
description:
Jan  8 08:23:13 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.51.27, lip=66.85.158.91, TLS, session=<yqqHgtdHLNWlmjMb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2026-01-08 08:25:23 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:46262: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.87
country_id: 1210997
description:
2026-01-08 08:25:50 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.87]:50542: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 08:26:48 host2 sshd[15043]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-08 08:31:46 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:32899: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2026-01-08 08:31:58 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:55134: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 08:34:13 host2 sshd[21765]: Disconnected from invalid user admin 2.57.121.112 port 34669 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:39:01 host2 sshd[25930]: Disconnected from invalid user test 141.94.237.134 port 47428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:39:57 host2 sshd[26677]: Disconnected from invalid user ubuntu 141.94.237.134 port 38914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  8 08:40:31 host2 sshd[27439]: Disconnected from invalid user admin 141.94.237.134 port 37436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:40:37 host2 sshd[27559]: Disconnected from invalid user test 37.46.18.65 port 60132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-08 08:42:16 dovecot_login authenticator failed for H=([125.19.171.114]) [152.52.192.162]:52256: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:42:24 host2 sshd[29201]: Disconnected from invalid user deploy 37.46.18.65 port 40318 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-08 08:42:35 dovecot_login authenticator failed for H=([46.212.118.138]) [46.212.118.138]:60458: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:43:02 host2 sshd[29672]: Disconnected from invalid user admin 37.46.18.65 port 43170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.152
country_id: 798549
description:
2026-01-08 08:43:06 dovecot_login authenticator failed for H=(ADMIN) [91.90.120.152]:39369: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-08 08:47:28 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:53450: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-08 08:47:16 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:45175: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:48:53 host2 sshd[36838]: Disconnected from invalid user admin 37.46.18.65 port 51860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.18.65
country_id: 6252001
description:
Jan  8 08:49:34 host2 sshd[37547]: Disconnected from invalid user test 37.46.18.65 port 40564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:50:47 host2 sshd[38816]: Disconnected from invalid user ubuntu 185.196.10.62 port 38884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-08 08:52:37 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:57672: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-08 08:52:49 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:55712: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:56:08 host2 sshd[44604]: Disconnected from invalid user deploy 185.196.10.62 port 53664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-08 08:58:33 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:41210: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2026-01-08 08:58:46 dovecot_login authenticator failed for H=([80.88.102.128]) [80.88.102.128]:57284: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-08 08:59:12 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:27779: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  8 08:58:27 host2 sshd[46704]: Disconnected from invalid user user 185.196.10.62 port 33122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-01-08 08:59:28 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:45394: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan  8 09:01:27 host2 pure-ftpd[49578]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-08 09:02:33 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:50220: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-08 09:04:54 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:39886: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-08 09:05:26 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:52572: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.28
country_id: 6290252
description:
2026-01-08 09:07:43 dovecot_login authenticator failed for H=(ADMIN) [37.46.115.28]:58736: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-08 09:08:36 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:46676: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.61.22
country_id: 3144096
description:
2026-01-08 09:08:51 dovecot_login authenticator failed for H=(cm-178.232.61.22.get.no) [178.232.61.22]:46036: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2026-01-08 09:11:43 dovecot_login authenticator failed for H=([94.20.234.161]) [94.20.234.161]:55288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 09:11:54 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (ppp-2-85-77-70.home.otenet.gr) [62.103.27.217]:26315: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-08 09:12:03 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:34799: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.147
country_id: 1694008
description:
2026-01-08 09:11:25 dovecot_login authenticator failed for H=([124.105.219.170]) [124.105.218.147]:50422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  8 09:15:10 host2 sshd[61878]: Disconnected from invalid user user 2.57.121.25 port 12907 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:15:29 host2 sshd[62161]: Disconnected from invalid user admin1 51.132.176.37 port 47418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-08 09:18:03 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:37776: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-08 09:17:40 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:59968: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:19:08 host2 sshd[65288]: Disconnected from invalid user test 51.132.176.37 port 54964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.132.176.37
country_id: 2635167
description:
Jan  8 09:20:17 host2 sshd[66416]: Disconnected from invalid user deploy 51.132.176.37 port 54072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-08 09:20:27 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:53430: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-01-08 09:20:33 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it [93.42.227.251]:38892: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-08 09:20:40 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:34329: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.38.204
country_id: 390903
description:
2026-01-08 09:21:24 dovecot_login authenticator failed for H=(149-210-38-204.mobile.nym.cosmote.net) [149.210.38.204]:58760: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 09:22:22 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:52682: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:22:34 host2 sshd[68467]: Disconnected from invalid user admin1 190.167.90.67 port 56654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 09:23:34 host2 sshd[69290]: Disconnected from invalid user admin 2.57.121.112 port 25631 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:23:46 host2 sshd[69448]: Disconnected from invalid user deploy 190.167.90.67 port 60197 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-08 09:24:03 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:11597: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:24:25 host2 sshd[69945]: Disconnected from invalid user user1 200.108.174.4 port 51750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-08 09:24:28 dovecot_login authenticator failed for H=([118.200.42.112]) [118.200.42.112]:57696: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:25:58 host2 sshd[71421]: Disconnected from invalid user deploy 190.167.90.67 port 55844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:26:06 host2 sshd[71572]: Disconnected from invalid user ubuntu 24.199.94.128 port 45672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:27:05 host2 sshd[72362]: Disconnected from invalid user user 24.199.94.128 port 43792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:27:12 host2 sshd[72557]: Disconnected from invalid user user 200.108.174.4 port 50356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  8 09:27:36 host2 sshd[72895]: Disconnected from invalid user ubuntu 24.199.94.128 port 35660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  8 09:28:05 host2 sshd[73337]: Disconnected from invalid user ubuntu 190.167.90.67 port 47428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.19
country_id: 2635167
description:
2026-01-08 09:29:35 dovecot_login authenticator failed for H=(ADMIN) [194.110.13.19]:33817: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  8 09:29:44 host2 sshd[74651]: Disconnected from invalid user admin 200.108.174.4 port 46876 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-08 09:37:21 dovecot_login authenticator failed for H=([81.8.218.251]) [81.8.218.251]:49890: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-08 09:37:49 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:35586: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.105.235.55 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-08 09:42:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57629: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.66
country_id: 6252001
description:
Jan  8 09:42:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.66, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<e7AmndhHVseTuYVC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 09:46:07 host2 sshd[89704]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 09:47:33 host2 sshd[91342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2026-01-08 09:48:04 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:57604: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  8 09:48:14 host2 sshd[91884]: Disconnected from invalid user ubuntu 161.132.19.77 port 59444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-08 09:48:16 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:36230: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Jan  8 09:48:46 host2 sshd[92205]: Disconnected from invalid user ubuntu 175.100.24.139 port 51868 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 195.161.114.113 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.66
country_id: 6252001
description:
Jan  8 09:49:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.66, lip=66.85.158.91, TLS, session=<Na5nuNhHBOuTuYVC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-08 09:50:11 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:33384: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-08 09:51:03 dovecot_login authenticator failed for H=([62.97.161.137]) [62.97.161.137]:39142: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.144.54
country_id: 2510769
description:
2026-01-08 09:50:25 dovecot_login authenticator failed for H=(47-60-144-54.red-acceso.airtel.net) [47.60.144.54]:49447: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2026-01-08 09:50:35 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:39984: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  8 09:51:28 host2 sshd[94685]: Disconnected from invalid user test 161.132.19.77 port 51606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2026-01-08 09:55:05 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:58745: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-01-08 09:55:15 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:58016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-08 09:55:29 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:49675: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.12
country_id: 3057568
description:
2026-01-08 09:55:31 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.12]:61789: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-08 09:55:40 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:42492: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan  8 09:57:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<HX0T1dhHsLnE+2YQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.250.161
country_id: 3469034
description:
Jan  8 09:59:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.8.250.161, lip=66.85.158.91, TLS, session=<7XaO2thHOouxCPqh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.83
country_id: 3469034
description:
Jan  8 10:00:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=191.240.96.83, lip=66.85.158.91, TLS, session=</gLF29hHsLK/8GBT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 10:03:35 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:37408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-08 10:04:10 dovecot_login authenticator failed for H=(syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:51704: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:05:06 host2 sshd[109087]: Disconnected from invalid user admin 216.155.93.75 port 53332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-08 10:05:48 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:53815: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  8 10:05:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ByLl8dhHhJRChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-08 10:05:30 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:37616: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-08 10:09:44 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:52627: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 10:10:09 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:56198: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:10:11 host2 sshd[113781]: Disconnected from invalid user user 216.155.93.75 port 38862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  8 10:10:55 host2 sshd[114662]: Disconnected from invalid user user 216.155.93.75 port 45512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-08 10:11:53 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:44688: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-08 10:12:06 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:55030: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-08 10:11:41 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:38102: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Jan  8 10:13:47 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.91, session=<zHvrDdlH6rJSF7ch>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-08 10:14:32 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:57397: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-08 10:14:51 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:59176: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-08 10:16:20 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:59748: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-08 10:19:11 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:44880: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-08 10:18:59 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:46571: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2026-01-08 10:19:31 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:37792: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-08 10:20:25 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:48280: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-08 10:20:52 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:50950: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-01-08 10:21:17 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:50272: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-08 10:21:43 dovecot_login authenticator failed for H=([37.235.140.163]) [37.235.140.163]:57358: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.239.84.72
country_id: 2635167
description:
2026-01-08 10:24:09 dovecot_login authenticator failed for H=(ADMIN) [193.239.84.72]:11634: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  8 10:26:57 host2 sshd[129019]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 37148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-08 10:27:04 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:34070: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-08 10:27:31 dovecot_login authenticator failed for H=([182.95.20.13]) [122.187.41.18]:41496: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.244
country_id: 2186224
description:
2026-01-08 10:27:59 dovecot_login authenticator failed for H=([121.73.168.244]) [121.73.168.244]:52840: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.53.79.83
country_id: 1733045
description:
2026-01-08 10:32:17 dovecot_plain authenticator failed for H=(E1261D68V5UP6) [60.53.79.83]:57386: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:34:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ycpeWNlHttWTuYRr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:35:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yg5cXNlHzuOTuYRr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2026-01-08 10:37:21 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:51316: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 10:41:21 host2 sshd[142777]: Disconnected from invalid user admin 2.57.121.112 port 30731 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.107
country_id: 6252001
description:
Jan  8 10:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.107, lip=66.85.158.92, TLS, session=<pKysctlHUPWTuYRr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.157.111.178
country_id: 453733
description:
Jan  8 10:43:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.157.111.178, lip=66.85.158.91, TLS, session=<6KP8ddlHjJe5nW+y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan  8 10:44:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<O5A6e9lHeNXE+2YS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.138
country_id: 732800
description:
Jan  8 10:43:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.215.138, lip=66.85.158.91, TLS, session=<zm+qd9lHe625/9eK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.39
country_id: 2589581
description:
2026-01-08 10:43:47 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.39]:55245: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2026-01-08 10:44:41 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:39920: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-08 10:45:06 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:44128: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan  8 10:46:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<5pBihNlHYJbE+2YR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan  8 10:47:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<c5rZhtlHCqzE+2YP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  8 10:48:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, TLS: Connection closed, session=<kuvVidlHZOBV2ZUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Jan  8 10:48:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<Y3yPitlHUrnE+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-08 10:48:42 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:57940: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-08 10:49:02 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:4874: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-08 10:49:09 +0530] info [cpaneld] 62.171.146.247 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Jan  8 10:49:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, session=<Z4cxjdlHVvKTuYQ0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  8 10:48:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C6wkitlH+sxV2ZUM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-08 10:50:18 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:58656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-08 10:49:48 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:49564: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-08 10:50:34 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:46914: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:50:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<er+9kdlHELEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:52:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jMMEl9lHCskDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:52:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JCB3mNlHMMsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:53:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mQA/nNlHroQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:55:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tiIcotlHAroDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:56:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KtZyp9lH/NcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:57:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R9LvqtlHPpoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  8 10:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<EW6/sNlHzsQDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Jan  8 11:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<dwxXuNlH2t/E+2YO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Jan  8 11:04:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<Bsq1wtlHUtrE+2YN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.108
country_id: 3865483
description:
2026-01-08 11:06:14 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.108]:40565: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.253
country_id: 6252001
description:
Jan  8 11:10:24 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.253, lip=66.85.158.91, session=<UVFr2NlHYLcSYRP9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-08 11:12:08 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:45326: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2026-01-08 11:12:47 dovecot_login authenticator failed for H=([159.16.195.171]) [159.16.201.242]:53565: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 11:13:09 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([2.85.77.70]) [62.103.27.217]:64000: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Jan  8 11:19:58 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.92, session=<p8yf+tlHjNVSF7ch>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-08 11:21:28 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:63511: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-08 11:20:54 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:52460: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-08 11:21:15 dovecot_login authenticator failed for H=(187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:53188: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-08 11:22:07 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:49134: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-08 11:22:30 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:51722: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.189.114.123
country_id: 719819
description:
Jan  8 11:25:48 host2 pure-ftpd[186639]: (?@185.189.114.123) [INFO] New connection from 185.189.114.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.143
country_id: 3703430
description:
Jan  8 11:25:49 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.90.126.143, lip=66.85.158.91, session=<VLOSD9pHytVbWn6P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.4
country_id: 2328926
description:
Jan  8 11:25:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.4, lip=66.85.158.91, TLS, session=<LaWSD9pHIMCSRkEE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.239.140
country_id: 1227603
description:
Jan  8 11:25:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.239.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qEWUD9pHEsBfte+M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.78.54.132
country_id: 2750405
description:
Jan  8 11:25:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.78.54.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qXqYD9pHMMnDTjaE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.218
country_id: 2802361
description:
Jan  8 11:25:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.218.218, lip=66.85.158.91, session=<PzCVD9pHxtW11tra>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.169
country_id: 1269750
description:
Jan  8 11:25:48 host2 pure-ftpd[186614]: (?@103.108.174.169) [INFO] New connection from 103.108.174.169


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.11
country_id: 1605651
description:
Jan  8 11:25:50 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.11, lip=66.85.158.91, session=<42SUD9pHitut78kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.222
country_id: 3190538
description:
Jan  8 11:25:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.222, lip=66.85.158.91, session=<RpCYD9pHhtvDUJbe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 11:28:05 host2 sshd[188581]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.197.134
country_id: 6252001
description:
2026-01-08 11:28:40 dovecot_login authenticator failed for H=(ADMIN) [37.19.197.134]:29166: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 11:29:39 host2 sshd[190302]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.34.70.2
country_id: 2510769
description:
2026-01-08 11:30:44 dovecot_login authenticator failed for H=2.red-83-34-70.dynamicip.rima-tde.net [83.34.70.2]:54243: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2026-01-08 11:31:10 dovecot_login authenticator failed for H=(telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:36157: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 11:44:51 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:34976: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-08 11:46:21 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:53311: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.73
country_id: 2186224
description:
2026-01-08 11:45:41 dovecot_login authenticator failed for H=([121.73.162.73]) [121.73.162.73]:47788: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-08 11:46:07 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:36792: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2026-01-08 11:46:46 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:34780: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.163
country_id: 2328926
description:
2026-01-08 11:48:07 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.163]:5263: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2026-01-08 11:49:46 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:43102: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2026-01-08 11:50:00 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:39888: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.69
country_id: 3469034
description:
Jan  8 11:53:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.11.251.69, lip=66.85.158.91, TLS, session=<mHQUcNpHtdWxC/tF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.253.237
country_id: 3469034
description:
Jan  8 11:53:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.8.253.237, lip=66.85.158.91, TLS, session=<kUNHcdpHyOyxCP3t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-08 11:54:24 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:46680: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-08 11:54:33 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:60306: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-08 11:54:41 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:38414: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 11:58:05 host2 sshd[219190]: Disconnected from invalid user admin 2.57.121.112 port 11916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-08 11:59:39 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (ppp-2-85-77-70.home.otenet.gr) [62.103.27.217]:44753: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-08 11:59:54 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:32930: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.199
country_id: 953987
description:
Jan  8 12:01:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.64.37.199, lip=66.85.158.91, TLS, session=<TTSlj9pHReRmQCXH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.50.35
country_id: 2963597
description:
Jan  8 12:02:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=37.203.50.35, lip=66.85.158.91, TLS, session=<hiN4kdpH870lyzIj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-08 12:03:44 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:63651: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-08 12:04:06 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:59951: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-08 12:06:33 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:55416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-08 12:06:49 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:42624: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2026-01-08 12:11:24 dovecot_login authenticator failed for H=([65.20.132.172]) [65.20.132.172]:58889: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.185
country_id: 2635167
description:
2026-01-08 12:13:51 dovecot_login authenticator failed for H=(ADMIN) [98.159.234.185]:58055: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  8 12:17:14 host2 sshd[238930]: Disconnected from invalid user user 2.57.121.25 port 23331 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-08 12:17:55 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4629: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-08 12:18:10 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:38028: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-01-08 12:22:29 dovecot_login authenticator failed for H=([49.125.201.68]) [49.125.201.68]:50632: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.128.180.14
country_id: 3437598
description:
2026-01-08 12:22:41 dovecot_login authenticator failed for H=(static-14-180-128-190.telecel.com.py) [190.128.180.14]:48277: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-08 12:29:24 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:37890: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.194
country_id: 2635167
description:
Jan  8 12:29:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.194, lip=66.85.158.91, session=<llUn89pHwvYjy9LC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-08 12:29:36 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:52812: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-08 12:30:15 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:44630: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2026-01-08 12:30:27 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:50964: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  8 12:30:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jIRn99pHjklChJmB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  8 12:30:50 host2 sshd[252166]: Disconnected from invalid user user1 122.168.194.41 port 40970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  8 12:32:43 host2 sshd[253834]: Disconnected from invalid user test 122.168.194.41 port 34282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-08 12:32:58 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (pelis) [174.169.224.27]:58262: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-08 12:34:14 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:51048: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-01-08 12:33:45 dovecot_plain authenticator failed for H=(razinash) [65.20.148.165]:53894: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-08 12:33:52 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:37880: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  8 12:34:44 host2 sshd[255628]: Disconnected from invalid user ubuntu 122.168.194.41 port 41640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-01-08 12:36:27 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:59062: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-08 12:36:38 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:55524: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2026-01-08 12:36:43 dovecot_login authenticator failed for H=(nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:47053: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-08 12:37:09 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:42155: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.164
country_id: 1562822
description:
2026-01-08 12:37:28 dovecot_login authenticator failed for H=(ADMIN) [173.239.247.164]:32415: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Jan  8 12:40:47 host2 sshd[261596]: Disconnected from invalid user user1 198.12.86.4 port 46248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-08 12:41:09 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:50482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-08 12:41:20 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:46590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.86.4
country_id: 6252001
description:
Jan  8 12:42:51 host2 sshd[263428]: Disconnected from invalid user deploy 198.12.86.4 port 35576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  8 12:44:10 host2 sshd[264546]: Disconnected from invalid user ubuntu 207.154.254.44 port 53290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  8 12:44:40 host2 sshd[265037]: Disconnected from invalid user test 207.154.254.44 port 53978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Jan  8 12:44:55 host2 sshd[265300]: Disconnected from invalid user admin1 198.12.86.4 port 53128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-08 12:46:28 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:41865: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  8 12:46:36 host2 sshd[267040]: Disconnected from invalid user admin1 207.154.254.44 port 59376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-01-08 12:46:44 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:46108: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-08 12:46:56 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:33099: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-08 12:48:13 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:60228: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2026-01-08 12:48:27 dovecot_login authenticator failed for H=244.79-161-138.customer.lyse.net [79.161.138.244]:41680: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.112
country_id: 6252001
description:
Jan  8 12:52:14 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.112, lip=66.85.158.92, session=<eCaTRNtHlNUUQcJw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-08 12:54:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57052: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.90
country_id: 6252001
description:
Jan  8 12:53:37 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.173.90, lip=66.85.158.91, session=<4eSHSdtH8tcofK1a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-08 12:55:19 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:45897: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-08 12:55:34 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:53638: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 12:59:49 host2 sshd[281391]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 13:01:05 host2 sshd[282715]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.88
country_id: 6252001
description:
2026-01-08 13:02:16 dovecot_login authenticator failed for H=(ADMIN) [158.173.153.88]:7180: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.209
country_id: 6252001
description:
Jan  8 13:04:18 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.209, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tzu7b9tHA9/N0h/R>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.164
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.164: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2026-01-08 13:08:17 dovecot_login authenticator failed for H=([223.197.153.135]) [223.197.153.135]:62549: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-01-08 13:08:39 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:39904: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 13:10:15 host2 sshd[291806]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Jan  8 13:09:44 host2 sshd[291169]: Disconnected from invalid user user 170.254.229.191 port 58508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  8 13:09:57 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<9pfPg9tHvt+Svhb3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 13:11:42 host2 sshd[293445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  8 13:11:42 host2 sshd[293432]: Disconnected from invalid user ubuntu 200.69.236.207 port 33774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Jan  8 13:13:37 host2 sshd[295524]: Disconnected from invalid user user 170.254.229.191 port 48302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-08 13:14:55 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:33762: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 13:14:07 host2 sshd[295936]: Disconnected from invalid user admin 2.57.121.112 port 50568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-08 13:14:31 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12149: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-08 13:15:31 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:60958: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.180.242.106
country_id: 3017382
description:
2026-01-08 13:16:18 dovecot_login authenticator failed for H=(106.242.180.159.in-addr.arpa.celeste.fr) [159.180.242.106]:60666: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-08 13:16:26 dovecot_login authenticator failed for H=([125.18.136.89]) [125.18.99.10]:48360: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.238.169
country_id: 6252001
description:
Jan  8 13:21:23 host2 pure-ftpd[302208]: (?@95.181.238.169) [INFO] New connection from 95.181.238.169


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.5
country_id: 1282988
description:
Jan  8 13:21:26 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.5, lip=66.85.158.91, session=<zvwGrdtHPKut9CEF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.112.24
country_id: 1210997
description:
Jan  8 13:21:26 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=64.64.112.24, lip=66.85.158.91, session=<7RIMrdtHYqhAQHAY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.213
country_id: 3190538
description:
Jan  8 13:21:27 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=195.80.150.213, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EwcbrdtHNujDUJbV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-08 13:25:52 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:47488: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.105
country_id: 3469034
description:
Jan  8 13:25:17 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.105, lip=66.85.158.91, TLS, session=<zw+audtHFbm7eElp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.188
country_id: 3469034
description:
Jan  8 13:25:18 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.120.72.188, lip=66.85.158.91, TLS, session=<WSqaudtHbsu7eEi8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-08 13:25:35 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:49438: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.204
country_id: 3865483
description:
Jan  8 13:25:39 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=186.96.195.204, lip=66.85.158.91, TLS, session=<w5HnuttHfK+6YMPM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.132
country_id: 1269750
description:
Jan  8 13:25:40 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=103.84.202.132, lip=66.85.158.91, TLS, session=<NHn5uttHXq9nVMqE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-01-08 13:29:49 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:33650: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.37
country_id: 3865483
description:
Jan  8 13:29:50 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.124.218.37, lip=66.85.158.91, TLS, session=<enfPydtH1q66fNol>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-08 13:30:14 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:44194: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.169
country_id: 6252001
description:
2026-01-08 13:30:30 dovecot_login authenticator failed for H=(ADMIN) [91.124.17.169]:64777: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.145
country_id: 732800
description:
Jan  8 13:30:07 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.255.215.145, lip=66.85.158.91, TLS, session=<IJUay9tHhpG5/9eR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2026-01-08 13:35:50 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:44328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 13:37:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (zygeti) [87.103.126.54]:5202: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.64
country_id: 6252001
description:
Jan  8 13:37:32 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.64, lip=66.85.158.92, TLS, session=<9RWa5ttHYPaTuYRA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 13:42:21 host2 sshd[321292]: Disconnected from invalid user admin 2.57.121.112 port 26453 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-01-08 13:43:14 dovecot_plain authenticator failed for H=(stoction) [87.121.76.190]:59902: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  8 13:46:12 host2 sshd[325193]: Disconnected from invalid user admin 95.58.255.251 port 44380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-08 13:46:52 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:57736: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-08 13:47:26 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:46455: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  8 13:47:52 host2 sshd[326664]: Disconnected from invalid user user 95.58.255.251 port 60082 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  8 13:48:24 host2 sshd[327147]: Disconnected from invalid user admin 95.58.255.251 port 52306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  8 13:48:26 host2 sshd[327099]: Disconnected from invalid user user 103.186.0.68 port 42310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  8 13:49:31 host2 sshd[328076]: Disconnected from invalid user deploy 95.58.255.251 port 52798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.80
country_id: 690791
description:
Jan  8 13:50:22 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.80, lip=66.85.158.91, TLS, session=<SX99E9xHNszCLIxQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  8 13:50:41 host2 sshd[329252]: Disconnected from invalid user deploy 103.186.0.68 port 59452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.107
country_id: 3469034
description:
Jan  8 13:50:43 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=187.120.76.107, lip=66.85.158.91, TLS, session=<P+ymFNxH45S7eExr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.87
country_id: 2921044
description:
2026-01-08 13:51:08 dovecot_login authenticator failed for H=(ADMIN) [191.101.157.87]:36168: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  8 13:53:46 host2 sshd[331821]: Disconnected from invalid user admin1 103.186.0.68 port 50604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.204.179.54
country_id: 6252001
description:
2026-01-08 13:54:26 dovecot_plain authenticator failed for H=ec2-34-204-179-54.compute-1.amazonaws.com (EC2AMAZ-LBU63OQ.ec2.internal) [34.204.179.54]:64507: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.202
country_id: 3175395
description:
Jan  8 13:54:29 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.202, lip=66.85.158.91, TLS, session=<eQwcItxHh4O5xQnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.221.148.134
country_id: 3469034
description:
Jan  8 13:55:10 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=131.221.148.134, lip=66.85.158.91, TLS, session=<AgSXJNxHO+2D3ZSG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.37.206.173
country_id: 3175395
description:
Jan  8 13:55:37 host2 sshd[334001]: Disconnected from invalid user ubuntu 151.37.206.173 port 64224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-08 13:58:05 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (wahet) [73.230.86.50]:55914: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:01:03 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<FwGtOtxHyKoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:01:42 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<cwwNPdxHON8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:02:34 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<yY0iQNxHTtkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-08 14:03:35 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (noskenener) [2.135.31.74]:52906: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:03:47 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<oAh1RNxHyM4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:04:26 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<lkXPRtxHvpQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.238
country_id: 6252001
description:
Jan  8 14:04:50 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.238, lip=66.85.158.91, session=<rypCSNxHyvrN0h/u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:06:05 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<CJe0TNxHQr8DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-08 14:05:51 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:39342: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-08 14:06:04 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:46324: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:06:44 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<NAQFT9xHEN4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:07:30 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<J8bLUdxHyN8DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:07:48 host2 dovecot[261790]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Yd7ZUtxHWKwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  8 14:08:53 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ZNm7VtxHNNQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-08 14:09:10 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:32946: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-08 14:09:30 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:53322: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-01-08 14:09:57 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:47806: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-08 14:10:02 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:39158: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-08 14:10:18 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:34154: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-08 14:10:39 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:37859: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.110.173.103
country_id: 2635167
description:
Jan  8 14:12:48 host2 dovecot[261790]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=143.110.173.103, lip=66.85.158.91, TLS, session=<GNm/ZNxHxNyPbq1n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.159.219.13
country_id: 2635167
description:
2026-01-08 14:12:51 dovecot_plain authenticator failed for H=(whamer) [185.159.219.13]:36713: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-08 14:13:43 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:50563: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.61
country_id: 6252001
description:
2026-01-08 14:14:03 dovecot_login authenticator failed for H=(ADMIN) [173.244.56.61]:46701: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  8 14:14:42 host2 sshd[350529]: Disconnected from invalid user admin 190.153.249.99 port 58920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-08 14:13:16 dovecot_login authenticator failed for H=([182.95.119.118]) [182.95.119.118]:60192: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  8 14:16:44 host2 sshd[352299]: Disconnected from invalid user admin 190.153.249.99 port 47530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  8 14:18:03 host2 sshd[353376]: Disconnected from invalid user user1 190.153.249.99 port 58758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  8 14:18:40 host2 sshd[354032]: Disconnected from invalid user user1 190.153.249.99 port 36138 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.75
country_id: 1880251
description:
Jan  8 14:20:44 host2 sshd[355920]: Disconnected from invalid user test 45.78.223.75 port 52954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  8 14:21:03 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<zkw6gtxHdLmLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Jan  8 14:21:47 host2 sshd[356818]: Disconnected from invalid user ubuntu 45.78.223.75 port 35474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.160.27.68
country_id: 1269750
description:
2026-01-08 14:22:18 dovecot_plain authenticator failed for H=(GXA8DC) [103.160.27.68]:50182: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Jan  8 14:25:41 host2 dovecot[261790]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<zYnLktxH3ty58uIR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.209.198.193
country_id: 2661886
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 185.209.198.193 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Jan  8 14:27:35 host2 dovecot[261790]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<GOGVmdxHvoO58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-08 14:28:51 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:46722: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-08 14:28:34 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:38445: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  8 14:30:02 host2 sshd[364133]: Disconnected from invalid user rootftp 172.208.24.217 port 43150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-08 14:30:27 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:39937: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-08 14:31:21 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (horing) [24.127.53.61]:58964: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  8 14:33:17 host2 sshd[367073]: Disconnected from invalid user ubuntu 172.208.24.217 port 12846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.156
country_id: 102358
description:
2026-01-08 14:35:39 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.156]:17259: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:37:00 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<BcY9u9xHLNMDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  8 14:36:21 host2 sshd[369870]: Disconnected from invalid user user 172.208.24.217 port 33952 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.101
country_id: 6252001
description:
Jan  8 14:37:21 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.101, lip=66.85.158.91, TLS, session=<tFqMvNxHnufN0h9l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.234
country_id: 2186224
description:
2026-01-08 14:37:26 dovecot_login authenticator failed for H=([121.73.169.234]) [121.73.169.234]:36998: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-08 14:37:41 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:44699: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:37:49 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<qLIyvtxHZMYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:39:41 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<fhfjxNxHBMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:40:30 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<1fvHx9xHtJEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:41:13 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<S7BbytxHOK8DlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:43:06 host2 dovecot[261790]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<gYwO0dxHqNoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:42:51 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<I/0u0NxHGtQDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:43:56 host2 dovecot[261790]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<psAM1NxHRr0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:43:41 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<SOAl09xHaqQDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Jan  8 14:44:15 host2 sshd[376769]: Disconnected from invalid user admin 52.169.142.214 port 33744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:44:58 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<GY7G19xHHscDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Jan  8 14:45:01 host2 sshd[377350]: Disconnected from invalid user deploy 167.99.78.165 port 36170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-08 14:45:30 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (monsomy) [196.47.172.253]:41096: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  8 14:45:43 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<+aZy2txHoqsDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Jan  8 14:45:53 host2 sshd[378367]: Disconnected from invalid user admin 52.169.142.214 port 58834 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Jan  8 14:45:56 host2 sshd[378405]: Disconnected from invalid user ubuntu 93.113.63.124 port 59736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Jan  8 14:46:27 host2 sshd[378826]: Disconnected from invalid user admin 52.169.142.214 port 33866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Jan  8 14:47:37 host2 sshd[379729]: Disconnected from invalid user ubuntu 167.99.78.165 port 51496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 14:48:03 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:44224: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  8 14:48:12 host2 sshd[380216]: Disconnected from invalid user ubuntu 93.113.63.124 port 38848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-08 14:48:40 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:34768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.59.137.151
country_id: 3175395
description:
2026-01-08 14:48:56 dovecot_plain authenticator failed for H=(inters) [151.59.137.151]:34664: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-08 14:49:01 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:43450: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.78.165
country_id: 1880251
description:
Jan  8 14:49:00 host2 sshd[381324]: Disconnected from invalid user deploy 167.99.78.165 port 51880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.157
country_id: 3865483
description:
Jan  8 14:50:15 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.251.157, lip=66.85.158.91, TLS, session=<0Ppr6dxH5dOzAPud>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.38
country_id: 226074
description:
Jan  8 14:50:37 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=196.0.107.38, lip=66.85.158.91, TLS, session=<diPB6txHDdTEAGsm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Jan  8 14:51:11 host2 sshd[383357]: Disconnected from invalid user admin1 52.169.142.214 port 49398 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 14:52:16 host2 sshd[384282]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 14:53:42 host2 sshd[385508]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-08 14:54:08 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:49122: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.161
country_id: 3017382
description:
Jan  8 14:57:49 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.161, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bX21Bd1HpdhbxJih>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.167
country_id: 3017382
description:
Jan  8 14:57:52 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.167, lip=66.85.158.92, TLS: Connection closed, session=<5LflBd1HIa1bxJin>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.150
country_id: 3017382
description:
Jan  8 14:57:30 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.150, lip=66.85.158.92, TLS: Connection closed, session=<fWqVBN1Hob9bxJiW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-01-08 14:57:36 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:58487: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2026-01-08 14:57:58 dovecot_login authenticator failed for H=(183.82.32.104.actcorp.in) [183.82.32.104]:53432: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.160
country_id: 3017382
description:
Jan  8 14:57:19 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.160, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BmL0A91HXZxbxJig>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  8 14:59:44 host2 sshd[391027]: Disconnected from invalid user deploy 200.196.50.91 port 45083 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  8 15:01:11 host2 sshd[392427]: Disconnected from invalid user admin 200.196.50.91 port 58742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.193.72
country_id: 130758
description:
Jan  8 15:02:27 host2 sshd[393582]: Disconnected from invalid user ubuntu 85.133.193.72 port 51610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.193.72
country_id: 130758
description:
Jan  8 15:03:58 host2 sshd[394841]: Disconnected from invalid user ubuntu 85.133.193.72 port 35560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-08 15:04:28 dovecot_login authenticator failed for H=([154.146.240.123]) [154.146.240.123]:39406: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.29
country_id: 3194884
description:
2026-01-08 15:04:20 dovecot_login authenticator failed for H=(ADMIN) [176.125.229.29]:25845: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.213.244
country_id: 3175395
description:
Jan  8 15:05:12 host2 sshd[395972]: Disconnected from invalid user ubuntu 151.19.213.244 port 10734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-08 15:09:43 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (ousing) [73.213.237.28]:58170: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-08 15:11:48 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (calogi) [217.215.74.195]:32799: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-08 15:13:30 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:38834: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-08 15:13:49 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:39076: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-08 15:15:52 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:57414: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-08 15:16:15 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:46640: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.19.213.244
country_id: 3175395
description:
Jan  8 15:16:27 host2 sshd[406416]: Disconnected from invalid user user1 151.19.213.244 port 10472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-08 15:19:16 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:35062: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-08 15:20:02 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:45774: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.28.110
country_id: 3175395
description:
Jan  8 15:20:45 host2 sshd[410210]: Disconnected from invalid user admin 151.47.28.110 port 25284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.28.110
country_id: 3175395
description:
Jan  8 15:23:34 host2 sshd[412521]: Disconnected from invalid user deploy 151.47.28.110 port 25457 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.47.28.110
country_id: 3175395
description:
Jan  8 15:24:16 host2 sshd[413083]: Disconnected from invalid user admin 151.47.28.110 port 25197 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-08 15:27:43 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:40456: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-08 15:28:01 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:48490: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-08 15:29:12 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (inonexpal) [73.213.237.28]:40038: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.86
country_id: 298795
description:
2026-01-08 15:29:20 dovecot_login authenticator failed for H=(ADMIN) [188.213.34.86]:22946: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-08 15:34:56 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:43041: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.128.18
country_id: 3144096
description:
2026-01-08 15:35:25 dovecot_login authenticator failed for H=(cm-178.232.128.18.get.no) [178.232.128.18]:51054: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-08 15:38:48 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:32992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-08 15:39:04 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:34459: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-08 15:41:12 dovecot_login authenticator failed for H=([125.19.175.93]) [182.95.176.122]:48560: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-08 15:41:56 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:57326: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 15:44:28 host2 sshd[431866]: Disconnected from invalid user admin 2.57.121.112 port 51886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.142
country_id: 1269750
description:
Jan  8 15:46:08 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.18.166.142, lip=66.85.158.91, TLS, session=<iSNasd1HP+ZnEqaO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.41.222
country_id: 6290252
description:
Jan  8 15:46:25 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.207.41.222, lip=66.85.158.91, TLS, session=<MEOLst1HVeptzyne>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.251
country_id: 2635167
description:
Jan  8 15:46:33 host2 dovecot[261790]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS, session=<XywDtN1HIe5X7LD7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Jan  8 15:46:34 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.85, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BVMQtN1HnaNX7LBV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 15:47:05 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (jugicus) [87.103.126.54]:58478: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Jan  8 15:47:07 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<y50Mtt1Hs7lX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.109
country_id: 2635167
description:
Jan  8 15:47:41 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.109, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<O+wHuN1HX8S594lt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Jan  8 15:48:14 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<a10Dut1HJa1X7LBM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2026-01-08 15:48:32 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:48364: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.77
country_id: 2635167
description:
Jan  8 15:48:47 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.77, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<AcP+u91H/99X7LBN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-08 15:49:00 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:60006: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Jan  8 15:49:20 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aCz4vd1HO41X7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.75
country_id: 2635167
description:
Jan  8 15:49:54 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.75, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Fnv3v91H7aBX7LBL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.42.209
country_id: 1819730
description:
Jan  8 15:50:24 host2 pure-ftpd[437654]: (?@165.154.42.209) [INFO] New connection from 165.154.42.209


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Jan  8 15:50:27 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<b8Hywd1HG5e594lR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-08 15:50:38 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:43545: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.91
country_id: 2635167
description:
Jan  8 15:51:00 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<TzPsw91H+Y+594lb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-01-08 15:50:20 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:43823: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Jan  8 15:51:33 host2 dovecot[261790]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=</3bnxd1HGYRX7LBn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.14.205
country_id: 3469034
description:
Jan  8 15:57:50 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.236.14.205, lip=66.85.158.91, TLS, session=<ortR291Hmsy67A7N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.183
country_id: 3865483
description:
Jan  8 15:58:12 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.250.183, lip=66.85.158.91, TLS, session=<mA+B3N1HTM6zAPq3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.92.114
country_id: 1269750
description:
Jan  8 16:00:15 host2 sshd[447155]: Disconnected from invalid user deploy 106.51.92.114 port 51784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.179
country_id: 2635167
description:
2026-01-08 16:00:39 dovecot_login authenticator failed for H=(ADMIN) [98.159.234.179]:25816: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.92.114
country_id: 1269750
description:
Jan  8 16:02:15 host2 sshd[448885]: Disconnected from invalid user admin1 106.51.92.114 port 43784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-01-08 16:02:41 dovecot_login authenticator failed for H=([122.187.181.57]) [182.95.174.178]:58648: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-08 16:02:51 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:44409: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-08 16:04:04 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (focank) [68.82.141.145]:47180: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-08 16:07:07 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:54264: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-08 16:06:47 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:37434: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2026-01-08 16:09:52 dovecot_login authenticator failed for H=([187.12.112.186]) [187.12.112.186]:50831: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Jan  8 16:10:21 host2 sshd[457222]: Disconnected from invalid user admin 154.92.109.196 port 9605 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-08 16:10:25 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:35104: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.114
country_id: 1269750
description:
2026-01-08 16:10:35 dovecot_login authenticator failed for H=([182.78.120.220]) [182.95.49.114]:33104: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-08 16:15:25 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:49502: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-08 16:15:40 dovecot_login authenticator failed for H=([182.95.230.158]) [182.95.230.158]:49986: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-08 16:16:17 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:44702: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-08 16:16:39 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:57210: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-08 16:17:06 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:58456: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2026-01-08 16:17:21 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:60064: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  8 16:19:26 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BbedKd5HhElChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.63
country_id: 6251999
description:
2026-01-08 16:19:18 dovecot_login authenticator failed for H=(ADMIN) [181.214.153.63]:17035: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-08 16:22:56 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:54254: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2026-01-08 16:22:45 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:34189: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.204.23.12
country_id: 6252001
description:
Jan  8 16:23:52 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=67.204.23.12, lip=66.85.158.91, TLS, session=<HNl8ON5H4tFDzBcM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-08 16:23:52 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:60520: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.51.254
country_id: 290291
description:
2026-01-08 16:23:34 dovecot_login authenticator failed for H=([87.236.51.254]) [87.236.51.254]:35781: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.71
country_id: 3865483
description:
Jan  8 16:24:14 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.252.71, lip=66.85.158.91, TLS, session=<ZiOfOd5H5pWzAPxH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-01-08 16:31:06 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:51609: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-08 16:31:01 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:42218: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 16:33:19 host2 sshd[477936]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-08 16:33:32 dovecot_login authenticator failed for H=([182.95.50.154]) [182.95.50.154]:38646: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2026-01-08 16:33:43 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:49058: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 16:34:45 host2 sshd[478840]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-08 16:42:42 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:59160: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-08 16:43:24 dovecot_login authenticator failed for H=(cm-178.232.226.163.get.no) [178.232.226.163]:34257: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-08 16:44:22 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:46693: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.224
country_id: 1733045
description:
2026-01-08 16:44:44 dovecot_login authenticator failed for H=([49.124.152.224]) [49.124.152.224]:36788: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2026-01-08 16:46:36 dovecot_login authenticator failed for H=(200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:41892: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-08 16:46:41 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:32972: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-08 16:46:57 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:51744: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.148
country_id: 1269750
description:
2026-01-08 16:47:37 dovecot_login authenticator failed for H=(nsg-corporate-148.227.187.122.airtel.in) [122.187.227.148]:57904: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-08 16:47:49 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:51306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.237.154
country_id: 6252001
description:
Jan  8 16:49:35 host2 sshd[490250]: Disconnected from invalid user test 128.14.237.154 port 17986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.235
country_id: 1819730
description:
2026-01-08 16:49:56 dovecot_login authenticator failed for H=(ADMIN) [86.107.104.235]:35208: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-08 16:54:38 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (fignack) [24.23.125.83]:47698: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-08 17:02:17 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (vorrus) [98.204.134.124]:33984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-08 17:02:36 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:58740: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-08 17:02:55 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:39002: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2026-01-08 17:04:44 dovecot_login authenticator failed for H=(187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:38222: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 17:05:04 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:47924: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-08 17:06:51 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (candainne) [71.235.225.181]:57450: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.44
country_id: 1733045
description:
2026-01-08 17:08:41 dovecot_login authenticator failed for H=([49.124.153.44]) [49.124.153.44]:51192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-08 17:10:59 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:45283: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2026-01-08 17:11:15 dovecot_login authenticator failed for H=pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:40308: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-08 17:13:15 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:54543: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.196
country_id: 2510769
description:
2026-01-08 17:14:07 dovecot_login authenticator failed for H=(cli-5b7e28c4.wholesale.adamo.es) [91.126.40.196]:57434: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-08 17:14:28 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:50324: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-08 17:13:36 dovecot_login authenticator failed for H=(189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:45080: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Jan  8 17:13:42 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=89.248.167.131, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A2+z695HBt5Z+KeD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.26
country_id: 2589581
description:
2026-01-08 17:17:02 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.26]:22353: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.106.237
country_id: 1269750
description:
Jan  8 17:19:10 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=103.87.106.237, lip=66.85.158.91, TLS, session=<XKcU/t5HNrFnV2rt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.40
country_id: 1269750
description:
Jan  8 17:19:31 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<isuru>, method=PLAIN, rip=45.118.34.40, lip=66.85.158.91, TLS, session=<a4Na/95HwYEtdiIo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.169.0.106
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 185.169.0.106 - topview "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-08 17:29:32 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (breben) [98.227.25.115]:44914: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2026-01-08 17:30:24 dovecot_login authenticator failed for H=([117.245.138.2]) [117.245.138.2]:42229: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-08 17:30:54 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:36064: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2026-01-08 17:31:15 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:36770: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Jan  8 17:32:19 host2 sshd[523181]: Disconnected from invalid user deploy 152.42.165.179 port 45578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-08 17:33:04 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:56320: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  8 17:33:08 host2 pure-ftpd[523759]: (?@66.132.153.129) [INFO] New connection from 66.132.153.129


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  8 17:33:15 host2 pure-ftpd[523830]: (?@66.132.153.129) [INFO] New connection from 66.132.153.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-08 17:33:25 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:35223: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-01-08 17:33:48 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:50609: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.165.179
country_id: 1880251
description:
Jan  8 17:33:57 host2 sshd[524343]: Disconnected from invalid user ubuntu 152.42.165.179 port 54996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-08 17:34:09 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:46526: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.225
country_id: 1269750
description:
Jan  8 17:34:11 host2 sshd[524558]: Disconnected from invalid user test 130.250.191.225 port 37494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.225
country_id: 1269750
description:
Jan  8 17:35:33 host2 sshd[526040]: Disconnected from invalid user test 130.250.191.225 port 49008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-08 17:35:45 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:45946: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.53
country_id: 6252001
description:
2026-01-08 17:36:00 dovecot_login authenticator failed for H=(ADMIN) [37.19.221.53]:2478: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-08 17:36:02 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:41474: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.225
country_id: 1269750
description:
Jan  8 17:36:14 host2 sshd[526504]: Disconnected from invalid user test 130.250.191.225 port 37256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-08 17:37:54 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:54837: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-08 17:38:26 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:55556: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Jan  8 17:38:56 host2 sshd[528383]: Disconnected from invalid user user1 152.32.172.161 port 45378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Jan  8 17:39:36 host2 sshd[528876]: Disconnected from invalid user test 152.32.172.161 port 43226 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.125
country_id: 2635167
description:
Jan  8 17:44:04 host2 pure-ftpd[532389]: (?@87.236.176.125) [INFO] New connection from 87.236.176.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2026-01-08 17:44:23 dovecot_login authenticator failed for H=(nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:59805: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-08 17:44:51 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:38083: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2026-01-08 17:50:21 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:64392: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.31
country_id: 2635167
description:
2026-01-08 17:50:57 dovecot_login authenticator failed for H=(0EmqhSRx) [23.132.164.31]:50779: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.31
country_id: 2635167
description:
2026-01-08 17:51:15 dovecot_login authenticator failed for H=(RZ1MBrX) [23.132.164.31]:53123: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 23.132.164.31
country_id: 2635167
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[23.132.164.31] [Authentication Database]=[mail] [Username]=[hr@lezzarotech.com] (5/5 failures) (blocked until [Thu Jan  8 12:36:50 2026 UTC/Thu Jan  8 18:06:50 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-08 17:52:56 dovecot_plain authenticator failed for H=(kably) [96.85.104.2]:57382: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 143.20.185.63
country_id: 6252001
description:
2026-01-08 17:56:15 H=([143.20.185.63]) [143.20.185.63]:64967 F=<account-security-noreply@accountprotection.microsoft.com> rejected RCPT <contact@bostonlanka.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.30
country_id: 2658434
description:
2026-01-08 18:00:52 dovecot_login authenticator failed for H=(ADMIN) [158.173.152.30]:42748: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-08 18:03:34 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:37636: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2026-01-08 18:03:54 dovecot_login authenticator failed for H=104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:34502: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  8 18:04:53 host2 sshd[551468]: Disconnected from invalid user admin1 27.254.152.90 port 40978 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Jan  8 18:05:22 host2 sshd[552088]: Disconnected from invalid user deploy 190.0.63.226 port 47220 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 18:07:34 host2 sshd[554100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Jan  8 18:08:03 host2 sshd[554602]: Disconnected from invalid user user 190.0.63.226 port 45402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Jan  8 18:08:43 host2 sshd[555256]: Disconnected from invalid user deploy 190.0.63.226 port 58568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Jan  8 18:09:52 host2 sshd[556335]: Disconnected from invalid user deploy 103.13.206.152 port 50118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.13.24.118
country_id: 3865483
description:
Jan  8 18:09:08 host2 sshd[555813]: Disconnected from invalid user ubuntu 186.13.24.118 port 38064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-08 18:11:36 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:59711: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-08 18:11:13 dovecot_login authenticator failed for H=([182.78.209.116]) [182.78.64.18]:46302: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.125.178.143
country_id: 2510769
description:
2026-01-08 18:11:53 dovecot_login authenticator failed for H=([87.125.178.143]) [87.125.178.143]:37326: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-08 18:12:12 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:51016: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-08 18:12:17 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (oulasthic) [24.1.200.187]:55344: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2026-01-08 18:12:25 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:51795: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.13.24.118
country_id: 3865483
description:
Jan  8 18:14:38 host2 sshd[561046]: Disconnected from invalid user admin 186.13.24.118 port 37820 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 18:14:46 host2 sshd[561174]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 18:16:13 host2 sshd[562427]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.107
country_id: 6252001
description:
Jan  8 18:17:36 host2 pure-ftpd[563742]: (?@195.184.76.107) [INFO] New connection from 195.184.76.107


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.104
country_id: 6252001
description:
Jan  8 18:17:36 host2 pure-ftpd[563744]: (?@195.184.76.104) [INFO] New connection from 195.184.76.104


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.152
country_id: 1643084
description:
Jan  8 18:17:36 host2 sshd[563660]: Disconnected from invalid user ubuntu 103.13.206.152 port 54496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.152
country_id: 1643084
description:
Jan  8 18:16:47 host2 sshd[562742]: Disconnected from invalid user deploy 103.13.206.152 port 40120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-08 18:18:20 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:54462: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.214.97.96
country_id: 2510769
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 185.214.97.96 - admin_venee "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-08 18:18:48 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:50460: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  8 18:20:21 host2 sshd[566049]: Disconnected from invalid user user 2.57.121.25 port 52101 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.52.72.49
country_id: 1605651
description:
2026-01-08 18:22:26 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [182.52.72.49]:49960: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2026-01-08 18:22:45 dovecot_login authenticator failed for H=([2.55.88.51]) [2.55.88.51]:53044: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.58
country_id: 953987
description:
2026-01-08 18:24:53 dovecot_login authenticator failed for H=(ADMIN) [154.47.30.58]:14690: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 18:33:58 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (himent) [87.103.126.54]:14013: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.200
country_id: 690791
description:
2026-01-08 18:33:43 H=([77.83.39.200]) [77.83.39.200]:65343 F=<dpr@priv8shop.com> rejected RCPT <callmegeneralak47@hotmail.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.200
country_id: 690791
description:
2026-01-08 18:35:12 H=([77.83.39.200]) [77.83.39.200]:54825 F=<dpr@priv8shop.com> rejected RCPT <callmegeneralak47@hotmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-08 18:36:49 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:57894: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 18:36:57 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:35260: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-01-08 18:37:52 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.179]:59790: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-08 18:38:25 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43677: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-08 18:48:05 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:51638: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-08 18:48:05 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:33964: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2026-01-08 18:48:21 dovecot_login authenticator failed for H=(nsg-corporate-134.184.185.122.airtel.in) [182.95.226.82]:49312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.228.161.66
country_id: 1327865
description:
Jan  8 18:54:24 host2 sshd[583312]: Disconnected from invalid user deploy 136.228.161.66 port 59574 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 18:54:41 host2 sshd[583350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-01-08 18:55:47 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:53262: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2026-01-08 18:55:54 dovecot_login authenticator failed for H=92.40.62.72.threembb.co.uk [92.40.62.72]:58730: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-08 18:56:03 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:51630: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-08 18:56:09 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:46888: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-08 18:56:21 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:50060: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-08 18:56:59 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:18549: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2026-01-08 18:56:43 dovecot_login authenticator failed for H=([128.185.224.142]) [27.123.97.74]:54332: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-08 18:59:54 dovecot_login authenticator failed for H=([178.232.226.163]) [178.232.226.163]:48331: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-08 18:59:41 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:39265: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  8 19:02:48 host2 sshd[588419]: Disconnected from invalid user ubuntu 159.89.143.86 port 47566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.165
country_id: 3077311
description:
Jan  8 19:04:21 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=217.75.222.165, lip=66.85.158.91, TLS, session=<3HpnduBHArvZS96l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.132
country_id: 6290252
description:
Jan  8 19:04:39 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.206.98.132, lip=66.85.158.91, TLS, session=<eBh7d+BHkJltzmKE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-08 19:07:10 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (unjum) [98.193.112.85]:35238: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  8 19:07:32 host2 sshd[592050]: Disconnected from invalid user test 101.36.124.127 port 44386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan  8 19:07:43 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<rb1Vg+BH3r3E+2YL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  8 19:11:12 host2 sshd[595239]: Disconnected from invalid user ubuntu 101.36.124.127 port 34830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.56
country_id: 3865483
description:
2026-01-08 19:12:35 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.56]:49624: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-08 19:13:58 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (resticar) [68.46.148.180]:45136: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-08 19:14:40 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:51603: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-08 19:15:03 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:59772: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.197
country_id: 2635167
description:
Jan  8 19:16:29 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.197, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IbzJouBH5c+594nF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.37
country_id: 2635167
description:
Jan  8 19:15:55 host2 dovecot[261790]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.37, lip=66.85.158.92, TLS, session=<+Yq9oOBHB4JX7LAl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.203
country_id: 2635167
description:
Jan  8 19:15:56 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.203, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<S5nJoOBHxde594nL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2026-01-08 19:16:58 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:51890: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.188
country_id: 2635167
description:
Jan  8 19:17:02 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.188, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<8ULEpOBHd+S594m8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 19:17:43 host2 sshd[601163]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Jan  8 19:17:36 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.196, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<rY+/puBHm4BX7LDE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-08 19:17:38 dovecot_login authenticator failed for H=([65.20.174.63]) [65.20.174.63]:57355: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.199
country_id: 2635167
description:
Jan  8 19:18:09 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.199, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Otu6qOBHhaRX7LDH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 19:19:10 host2 sshd[602270]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Jan  8 19:19:30 host2 sshd[602489]: Disconnected from invalid user deploy 64.227.131.199 port 49888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.190
country_id: 2635167
description:
Jan  8 19:18:42 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.190, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VUO0quBHoZi594m+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Jan  8 19:19:15 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<doOxrOBHG4pX7LDC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.200
country_id: 2635167
description:
Jan  8 19:19:49 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.200, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<MNisruBH08q594nI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.214
country_id: 2635167
description:
Jan  8 19:20:22 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.214, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<iUemsOBHL6VX7LDW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Jan  8 19:20:55 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<CY2hsuBHieZX7LDC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan  8 19:22:31 host2 sshd[605075]: Disconnected from invalid user user 103.25.47.94 port 40612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan  8 19:23:25 host2 sshd[605894]: Disconnected from invalid user test 103.25.47.94 port 52294 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-08 19:22:53 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:57844: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan  8 19:23:08 host2 sshd[605730]: Disconnected from invalid user test 161.18.228.75 port 40784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2026-01-08 19:23:24 dovecot_login authenticator failed for H=(nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:36864: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.25.47.94
country_id: 1269750
description:
Jan  8 19:24:13 host2 sshd[606544]: Disconnected from invalid user ubuntu 103.25.47.94 port 35744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.125.94.71
country_id: 1643084
description:
Jan  8 19:24:07 host2 sshd[606518]: Disconnected from invalid user ubuntu 202.125.94.71 port 44744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-08 19:24:11 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:48024: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Jan  8 19:25:41 host2 sshd[608025]: Disconnected from invalid user admin 103.25.47.94 port 59102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-08 19:28:24 dovecot_plain authenticator failed for H=(chozogrete) [24.105.248.218]:58718: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.125.94.71
country_id: 1643084
description:
Jan  8 19:28:50 host2 sshd[610925]: Disconnected from invalid user ubuntu 202.125.94.71 port 42240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 19:29:11 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (perthir) [87.103.126.54]:15851: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Jan  8 19:29:23 host2 sshd[611406]: Disconnected from invalid user user1 161.18.228.75 port 42602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.18.228.75
country_id: 3686110
description:
Jan  8 19:30:40 host2 sshd[612773]: Disconnected from invalid user admin 161.18.228.75 port 37320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  8 19:31:37 host2 sshd[613605]: Disconnected from invalid user admin 78.135.111.5 port 35930 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.135.111.5
country_id: 298795
description:
Jan  8 19:32:10 host2 sshd[614102]: Disconnected from invalid user admin 78.135.111.5 port 53108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Jan  8 19:32:12 host2 sshd[614125]: Disconnected from invalid user ubuntu 64.227.131.199 port 48376 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 19:32:41 host2 sshd[614524]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-08 19:33:51 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:46122: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.63
country_id: 1733045
description:
2026-01-08 19:34:10 dovecot_login authenticator failed for H=([49.124.153.63]) [49.124.153.63]:43906: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.62
country_id: 6252001
description:
2026-01-08 19:35:12 dovecot_login authenticator failed for H=(ADMIN) [151.241.122.62]:1128: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  8 19:36:10 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS: Connection closed, session=<mIAm6eBHyNlChJmB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-08 19:40:44 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:35022: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-08 19:41:00 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:59556: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-08 19:43:46 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (suistion) [98.193.112.85]:36642: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-08 19:44:44 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:43484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-08 19:44:58 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:54250: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 19:45:06 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:48082: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2026-01-08 19:44:41 dovecot_login authenticator failed for H=([213.230.65.53]) [213.230.65.53]:45172: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-08 19:52:35 dovecot_plain authenticator failed for H=(squing) [102.53.15.180]:48599: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-08 19:52:54 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36833: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-08 19:53:01 dovecot_plain authenticator failed for H=(hewsog) [50.202.197.108]:36383: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2026-01-08 19:53:17 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:42004: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Jan  8 19:53:28 host2 dovecot[261790]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS, session=<RlsPJ+FH0oXLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.41
country_id: 3057568
description:
2026-01-08 19:55:02 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.41]:25264: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-08 19:58:33 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:52544: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.30
country_id: 1733045
description:
2026-01-08 19:58:48 dovecot_login authenticator failed for H=([49.124.153.30]) [49.124.153.30]:36522: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 20:05:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (troan) [87.103.126.54]:32623: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-08 20:09:03 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:36618: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.37
country_id: 690791
description:
2026-01-08 20:09:11 dovecot_login authenticator failed for H=([91.214.84.37]) [91.214.84.37]:55617: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-01-08 20:11:14 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:36262: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2026-01-08 20:11:36 dovecot_login authenticator failed for H=([223.197.196.92]) [223.197.196.92]:50785: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-08 20:14:54 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (transing) [73.195.211.98]:56688: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-08 20:14:57 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (sucifercor) [24.15.216.41]:47224: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.11
country_id: 2635167
description:
Jan  8 20:15:55 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.11, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aM5Md+FH5dUjy9IL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2026-01-08 20:15:58 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:60040: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-08 20:16:25 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:46328: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 20:16:30 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:58697: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-08 20:16:52 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:47682: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-08 20:16:55 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:37008: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.11
country_id: 2635167
description:
Jan  8 20:16:59 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.11, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<IfYme+FHcPIjy9IL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2026-01-08 20:19:56 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:55305: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-08 20:20:30 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:57042: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.39
country_id: 3624060
description:
2026-01-08 20:22:56 dovecot_login authenticator failed for H=([186.177.88.39]) [186.177.88.39]:52380: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-08 20:23:47 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (sculang) [98.193.112.85]:35724: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.11
country_id: 2635167
description:
Jan  8 20:24:02 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.11, lip=66.85.158.91, TLS, session=<Zw5UlOFHTOkjy9IL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-08 20:25:46 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:51983: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-08 20:26:31 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:52940: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2026-01-08 20:28:06 dovecot_login authenticator failed for H=([103.79.237.54]) [103.79.237.54]:57950: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-08 20:28:32 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:51530: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-08 20:32:00 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:48226: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-08 20:32:16 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:56896: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-08 20:31:53 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:41937: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2026-01-08 20:32:24 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:36146: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.185
country_id: 6252001
description:
2026-01-08 20:36:36 dovecot_login authenticator failed for H=(ADMIN) [102.129.235.185]:13308: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.78
country_id: 3624060
description:
2026-01-08 20:36:57 dovecot_login authenticator failed for H=([186.177.88.78]) [186.177.88.78]:56669: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-08 20:37:31 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:35001: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 20:39:55 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:34222: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-08 20:39:42 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:52966: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-08 20:40:58 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:45880: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-08 20:41:23 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:33968: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  8 20:41:41 host2 sshd[666676]: Disconnected from invalid user user 2.83.107.150 port 59757 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  8 20:43:22 host2 sshd[667951]: Disconnected from invalid user user1 2.83.107.150 port 63194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  8 20:43:57 host2 sshd[668257]: Disconnected from invalid user user1 2.83.107.150 port 57110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-01-08 20:45:07 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:57109: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-08 20:44:50 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:52399: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.18
country_id: 6252001
description:
Jan  8 20:44:57 host2 pure-ftpd[668881]: (?@147.185.132.18) [INFO] New connection from 147.185.132.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  8 20:44:59 host2 sshd[668895]: Disconnected from invalid user test 2.83.107.150 port 49536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-08 20:46:10 dovecot_plain authenticator failed for H=(cally) [76.190.155.43]:48963: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  8 20:45:30 host2 sshd[669514]: Disconnected from invalid user ubuntu 2.83.107.150 port 60029 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Jan  8 20:47:37 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JCSz6OFH4M1APpyi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-08 20:47:50 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:37754: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-08 20:47:22 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:34144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.59.132.17
country_id: 798544
description:
Jan  8 20:48:43 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=193.59.132.17, lip=66.85.158.91, TLS, session=<UHak6+FHfN/BO4QR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.128
country_id: 690791
description:
Jan  8 20:49:01 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.11.128, lip=66.85.158.91, TLS, session=<z+zA7OFHdNCwZwuA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.56.236
country_id: 3077311
description:
Jan  8 20:54:00 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.199.56.236, lip=66.85.158.91, TLS, session=<KIyM/+FH1N+Kxzjs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.50.220.150
country_id: 3017382
description:
Jan  8 20:54:01 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=149.50.220.150, lip=66.85.158.91, session=<wpmb/+FHZJmVMtyW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.235.144
country_id: 102358
description:
Jan  8 20:53:58 host2 pure-ftpd[676229]: (?@95.181.235.144) [INFO] New connection from 95.181.235.144


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.230.154
country_id: 2562770
description:
Jan  8 20:53:57 host2 pure-ftpd[676218]: (?@176.125.230.154) [INFO] New connection from 176.125.230.154


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.208
country_id: 6252001
description:
Jan  8 20:53:21 host2 pure-ftpd[675701]: (?@205.210.31.208) [INFO] New connection from 205.210.31.208


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.8
country_id: 718075
description:
Jan  8 20:54:00 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.225.28.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MdiM/+FHyN+54RwI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 20:59:26 host2 sshd[681355]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 21:00:52 host2 sshd[682549]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-08 21:00:23 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:56178: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-08 21:00:50 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:55348: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.72
country_id: 2963597
description:
2026-01-08 21:02:15 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.72]:63214: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-08 21:10:13 dovecot_login authenticator failed for H=([182.78.10.145]) [122.185.101.50]:37956: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-08 21:09:36 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:39154: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-08 21:10:04 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:57988: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-08 21:11:22 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:47116: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  8 21:14:22 host2 sshd[692764]: Disconnected from invalid user user 150.95.82.21 port 58960 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  8 21:15:42 host2 sshd[693834]: Disconnected from invalid user ubuntu 150.95.82.21 port 54238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  8 21:16:26 host2 sshd[694296]: Disconnected from invalid user user 150.95.82.21 port 37764 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  8 21:17:17 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<yXjJUuJH7NNChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-08 21:17:52 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:36452: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-08 21:18:22 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:33530: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-08 21:18:24 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:41459: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2026-01-08 21:18:43 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:34830: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  8 21:20:05 host2 sshd[697274]: Disconnected from invalid user deploy 189.112.0.11 port 59560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.120
country_id: 3144096
description:
2026-01-08 21:20:49 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.120]:39410: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Jan  8 21:21:29 host2 sshd[698440]: Disconnected from invalid user admin 103.231.14.54 port 57090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Jan  8 21:22:07 host2 sshd[698980]: Disconnected from invalid user admin 103.231.14.54 port 42146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Jan  8 21:22:46 host2 sshd[699506]: Disconnected from invalid user admin 103.231.14.54 port 55630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  8 21:22:32 host2 sshd[699311]: Disconnected from invalid user user 189.112.0.11 port 50404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.137.5
country_id: 294640
description:
2026-01-08 21:23:23 dovecot_login authenticator failed for H=([84.111.137.5]) [84.111.137.5]:57100: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2026-01-08 21:23:49 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:34027: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  8 21:25:28 host2 sshd[701887]: Disconnected from invalid user admin 198.1.117.220 port 45434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  8 21:26:42 host2 sshd[702817]: Disconnected from invalid user test 198.1.117.220 port 36064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.84
country_id: 2635167
description:
Jan  8 21:27:05 host2 sshd[703117]: Disconnected from invalid user test 185.196.9.84 port 44558 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan  8 21:27:10 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.202, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jKglduJHUdSTuYXK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  8 21:27:17 host2 sshd[703312]: Disconnected from invalid user user1 198.1.117.220 port 47624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan  8 21:27:35 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.202, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ieihd+JHhOCTuYXK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  8 21:27:50 host2 sshd[703667]: Disconnected from invalid user user1 198.1.117.220 port 59188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-08 21:29:14 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:48093: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan  8 21:28:44 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.202, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<EYXEe+JHQP6TuYXK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-08 21:29:47 dovecot_login authenticator failed for H=([182.95.85.212]) [182.95.123.202]:54594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2026-01-08 21:30:11 dovecot_login authenticator failed for H=([152.52.14.137]) [182.79.89.14]:41530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Jan  8 21:30:41 host2 sshd[705895]: Disconnected from invalid user user 117.216.143.31 port 34082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2026-01-08 21:30:45 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:35033: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-01-08 21:31:11 dovecot_login authenticator failed for H=([65.20.187.47]) [65.20.187.47]:47064: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.84
country_id: 2635167
description:
Jan  8 21:32:34 host2 sshd[707248]: Disconnected from invalid user deploy 185.196.9.84 port 56006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.143.31
country_id: 1269750
description:
Jan  8 21:32:35 host2 sshd[707230]: Disconnected from invalid user test 117.216.143.31 port 58772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-08 21:33:36 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:49972: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-01-08 21:33:57 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:50272: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan  8 21:34:48 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.202, lip=66.85.158.92, TLS, session=<hOBzkeJHvvCTuYXK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.84
country_id: 2635167
description:
Jan  8 21:34:50 host2 sshd[708782]: Disconnected from invalid user user1 185.196.9.84 port 55674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.190
country_id: 1269750
description:
Jan  8 21:38:08 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.59.135.190, lip=66.85.158.91, TLS, session=<R8rSm+JHldtnO4e+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.248.20
country_id: 3469034
description:
Jan  8 21:38:27 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=186.224.248.20, lip=66.85.158.91, TLS, session=<K31yneJHoOy64PgU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-08 21:39:22 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:44328: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-08 21:39:39 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:60990: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.35
country_id: 2782113
description:
Jan  8 21:42:01 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.19.223.35, lip=66.85.158.91, TLS, session=<o2FDq+JHkqElE98j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.159
country_id: 2993457
description:
Jan  8 21:42:01 host2 dovecot[261790]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.233.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<znRDq+JHpL5ftemf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.254
country_id: 719819
description:
Jan  8 21:42:01 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=86.106.74.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dH5Dq+JHxopWakr+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.248
country_id: 3144096
description:
Jan  8 21:42:01 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.253.97.248, lip=66.85.158.91, TLS, session=<mZ1Dq+JHhNC5/WH4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.247.16
country_id: 1562822
description:
Jan  8 21:42:01 host2 dovecot[261790]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.239.247.16, lip=66.85.158.91, session=<6mBGq+JHaN+t7/cQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.25
country_id: 294640
description:
Jan  8 21:42:01 host2 dovecot[261790]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.25, lip=66.85.158.91, session=<yupBq+JHNJqVWBoZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-08 21:45:10 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (louces) [174.166.153.20]:35970: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.208
country_id: 798544
description:
2026-01-08 21:44:41 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.208]:21340: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.45.132.96
country_id: 3175395
description:
2026-01-08 21:47:16 dovecot_login authenticator failed for H=([151.45.132.96]) [151.45.132.96]:52906: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-08 21:47:34 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:48210: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2026-01-08 21:47:49 dovecot_plain authenticator failed for H=amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (wayest) [90.0.156.128]:48952: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.22.11.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 31.22.11.17 - kamechot "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 21:54:18 host2 sshd[737800]: Disconnected from invalid user admin 2.57.121.112 port 14929 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-08 21:58:59 dovecot_plain authenticator failed for H=(kaheaders) [176.113.155.132]:37555: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 21:58:57 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (comently) [87.103.126.54]:51322: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.156
country_id: 3865483
description:
Jan  8 22:01:10 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.238.106.156, lip=66.85.158.91, TLS, session=<Tqx37uJHROQt7mqc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.149.128
country_id: 690791
description:
Jan  8 22:01:05 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.221.149.128, lip=66.85.158.91, TLS, session=</P5o7uJHLOcl3ZWA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.171
country_id: 3175395
description:
Jan  8 22:01:05 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.171, lip=66.85.158.91, TLS, session=<hCNo7uJHBoK5D6ur>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.248
country_id: 3175395
description:
Jan  8 22:01:05 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.248, lip=66.85.158.91, TLS, session=<4U5q7uJHP5K5D6v4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.153
country_id: 3865483
description:
Jan  8 22:01:16 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.122.133.153, lip=66.85.158.91, TLS, session=<2v7S7uJHdtu+eoWZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.50
country_id: 3469034
description:
Jan  8 22:01:33 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=191.240.96.50, lip=66.85.158.91, TLS, session=<L+/a7+JHD9C/8GAy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.54
country_id: 3175395
description:
Jan  8 22:01:34 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.124.182.54, lip=66.85.158.91, TLS, session=<Po4q8OJHecC5fLY2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.219
country_id: 3175395
description:
Jan  8 22:01:24 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.219, lip=66.85.158.91, TLS, session=<WA+H7+JH89i5D6nb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.116
country_id: 3865483
description:
Jan  8 22:01:26 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=181.16.212.116, lip=66.85.158.91, TLS, session=<gLmX7+JHFby1ENR0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.233.64.153
country_id: 3469034
description:
Jan  8 22:01:39 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=170.233.64.153, lip=66.85.158.91, TLS, session=<MUE08OJHvbSq6UCZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.61
country_id: 2802361
description:
2026-01-08 22:04:17 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.61]:12951: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.40.172
country_id: 6252001
description:
Jan  8 22:05:47 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.83.40.172, lip=66.85.158.92, TLS, session=<2P04AONHAIcUUyis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:05:35 host2 sshd[746725]: Disconnected from invalid user admin 83.168.89.98 port 47470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-08 22:07:29 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57580: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-08 22:07:53 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:49030: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-08 22:08:11 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:57914: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-08 22:08:47 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:60807: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Jan  8 22:08:19 host2 sshd[748802]: Disconnected from invalid user user1 77.74.229.158 port 36154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-08 22:08:38 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:50726: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-08 22:08:25 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:54668: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Jan  8 22:10:01 host2 sshd[758980]: Disconnected from invalid user admin1 77.74.229.158 port 48716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:10:09 host2 sshd[759640]: Disconnected from invalid user ubuntu 179.32.33.161 port 50370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Jan  8 22:09:18 host2 sshd[754201]: Disconnected from invalid user admin 220.247.223.56 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 22:09:29 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (psiourly) [87.103.126.54]:63995: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Jan  8 22:10:28 host2 sshd[762143]: Disconnected from invalid user ubuntu 45.172.153.100 port 33382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:10:47 host2 sshd[762793]: Disconnected from invalid user user1 179.32.33.161 port 35502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:11:54 host2 sshd[763541]: Disconnected from invalid user user 83.168.89.98 port 49584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-08 22:12:15 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:47640: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  8 22:11:24 host2 sshd[763228]: Disconnected from invalid user ubuntu 179.32.33.161 port 48856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.127.126.162
country_id: 690791
description:
Jan  8 22:12:16 host2 sshd[763818]: Disconnected from invalid user ubuntu 93.127.126.162 port 51324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-08 22:12:14 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:58984: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-08 22:12:05 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:56044: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.89.98
country_id: 798544
description:
Jan  8 22:14:05 host2 sshd[765686]: Disconnected from invalid user user1 83.168.89.98 port 44222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-08 22:14:48 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:58894: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-08 22:15:02 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:45940: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.242
country_id: 1733045
description:
Jan  8 22:15:27 host2 sshd[766777]: Disconnected from invalid user user1 103.249.84.242 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:17:10 host2 sshd[767882]: Disconnected from invalid user ubuntu 68.183.224.170 port 56874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Jan  8 22:17:44 host2 dovecot[717960]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<byP4KuNHHFqnXpI1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:17:48 host2 sshd[768285]: Disconnected from invalid user user1 68.183.224.170 port 37116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-08 22:17:49 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38860: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.242
country_id: 1733045
description:
Jan  8 22:17:23 host2 sshd[768080]: Disconnected from invalid user deploy 103.249.84.242 port 58226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2026-01-08 22:18:59 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:59162: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  8 22:18:22 host2 sshd[768857]: Disconnected from invalid user user1 68.183.224.170 port 35406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-08 22:19:16 dovecot_login authenticator failed for H=([125.19.162.102]) [125.19.162.102]:51338: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-08 22:20:50 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:22205: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-08 22:21:00 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:47566: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-08 22:22:47 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (gasycarde) [71.235.225.181]:56010: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-08 22:27:58 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:46111: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-08 22:30:10 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:59418: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-08 22:30:13 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:41550: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.33
country_id: 2562770
description:
2026-01-08 22:29:30 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.33]:53298: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.243.30
country_id: 1269750
description:
2026-01-08 22:29:59 dovecot_login authenticator failed for H=([125.16.185.97]) [152.52.243.30]:55346: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-08 22:30:32 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:42264: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-08 22:30:46 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:36564: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-08 22:30:58 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:37729: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-08 22:31:33 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:55250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-01-08 22:32:54 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:60970: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-08 22:35:38 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:55731: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-08 22:36:05 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:38735: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-08 22:37:28 dovecot_login authenticator failed for H=(189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:42370: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-08 22:37:46 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:49533: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-08 22:38:05 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:57360: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-08 22:40:57 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:60762: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 22:41:21 host2 sshd[786820]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-08 22:41:27 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:36748: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  8 22:42:47 host2 sshd[787871]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.170
country_id: 6252001
description:
Jan  8 22:45:54 host2 dovecot[717960]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.192.170, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K+W2j+NHFpIUQcCq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.118
country_id: 1149361
description:
2026-01-08 22:50:48 dovecot_login authenticator failed for H=([149.54.62.118]) [149.54.62.118]:53558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.30.233
country_id: 1269750
description:
2026-01-08 22:51:07 dovecot_login authenticator failed for H=([59.90.30.233]) [59.90.30.233]:54486: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:52:46 host2 sshd[795133]: Disconnected from invalid user test 77.87.40.114 port 35688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.107
country_id: 298795
description:
2026-01-08 22:52:50 dovecot_login authenticator failed for H=(ADMIN) [188.213.34.107]:37633: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:54:52 host2 sshd[797603]: Disconnected from invalid user user1 206.217.131.233 port 39850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-08 22:55:09 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:42718: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-08 22:55:27 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:52212: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:57:22 host2 sshd[799675]: Received disconnect from 206.217.131.233 port 39592:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:57:47 host2 sshd[799917]: Disconnected from invalid user ubuntu 77.87.40.114 port 52860 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Jan  8 22:58:15 host2 sshd[800387]: Disconnected from invalid user admin1 77.87.40.114 port 35944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.85
country_id: 798544
description:
Jan  8 22:59:27 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=31.222.12.85, lip=66.85.158.91, TLS, session=<SAwpv+NH5skf3gxV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.131.233
country_id: 6252001
description:
Jan  8 22:59:29 host2 sshd[801513]: Disconnected from invalid user admin 206.217.131.233 port 56326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.209
country_id: 953987
description:
Jan  8 22:59:48 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.129.51.209, lip=66.85.158.91, TLS, session=<xSdNwONHZIZmgTPR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  8 23:07:05 host2 sshd[808027]: Disconnected from invalid user admin 2.57.121.112 port 28171 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-08 23:07:18 dovecot_plain authenticator failed for H=(penegly) [102.88.10.10]:54962: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-01-08 23:09:30 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:51602: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-08 23:09:43 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:64054: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-08 23:10:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (irdaeousts) [87.103.126.54]:10110: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 178.16.52.51 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2026-01-08 23:14:55 dovecot_login authenticator failed for H=(syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:36874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-08 23:15:15 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:40078: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Jan  8 23:17:21 host2 dovecot[717960]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS, session=</bE2AORHDpDLN4ME>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-08 23:17:44 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4688: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.14
country_id: 3042058
description:
2026-01-08 23:17:53 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.14]:39617: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-08 23:18:04 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:41691: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.151
country_id: 690791
description:
Jan  8 23:18:40 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.151, lip=66.85.158.91, TLS, session=<8wXaA+RHAsXCLIyX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.21.88
country_id: 690791
description:
Jan  8 23:18:59 host2 dovecot[717960]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.21.88, lip=66.85.158.91, TLS, session=<54f8BORHd5KwZxVY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-08 23:20:40 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:52841: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-08 23:21:03 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:41051: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-08 23:21:32 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:34756: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-08 23:21:36 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:53254: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-08 23:21:48 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:33566: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-08 23:22:09 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:58888: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-08 23:21:23 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:47318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan  8 23:32:49 host2 dovecot[821692]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan  8 23:35:26 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.91, session=<aLfZQORH0rtBMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.255.8.122
country_id: 2623032
description:
Jan  8 23:38:32 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.255.8.122, lip=66.85.158.91, TLS, session=<kVDxSuRHC8TC/wh6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.92
country_id: 2635167
description:
2026-01-08 23:38:41 dovecot_login authenticator failed for H=(ADMIN) [98.159.234.92]:20637: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-08 23:38:51 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:39496: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-08 23:39:31 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:38254: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.144
country_id: 3865483
description:
Jan  8 23:38:55 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=190.122.133.144, lip=66.85.158.91, TLS, session=<OxUlTORHYrO+eoWQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-08 23:39:14 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:52738: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-08 23:39:15 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:54934: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2026-01-08 23:44:15 dovecot_login authenticator failed for H=217.42.246.220.static.netvigator.com [220.246.42.217]:62384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-08 23:44:26 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:38870: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-08 23:44:44 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:53061: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-08 23:44:58 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:33786: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Jan  8 23:45:58 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.202, lip=66.85.158.91, session=<huSHZuRHQj+s7OTK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2026-01-08 23:49:29 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:37540: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-08 23:50:02 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:39746: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  8 23:54:02 host2 sshd[837282]: Disconnected from invalid user user1 191.6.25.239 port 39983 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:00:00 host2 sshd[842126]: Disconnected from invalid user ubuntu 191.6.25.239 port 42971 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-09 00:02:37 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:44832: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.24
country_id: 6290252
description:
2026-01-09 00:02:10 dovecot_login authenticator failed for H=(ADMIN) [37.46.115.24]:47668: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 00:03:39 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:59221: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-09 00:02:53 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:36205: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:03:10 host2 sshd[845041]: Disconnected from invalid user ubuntu 191.6.25.239 port 62175 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-09 00:04:11 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46560: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.6.25.239
country_id: 3469034
description:
Jan  9 00:04:47 host2 sshd[846068]: Disconnected from invalid user admin1 191.6.25.239 port 42057 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.226
country_id: 6252001
description:
Jan  9 00:05:31 host2 pure-ftpd[846882]: (?@205.210.31.226) [INFO] New connection from 205.210.31.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2026-01-09 00:07:44 dovecot_login authenticator failed for H=([103.79.237.54]) [103.79.237.54]:57722: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-09 00:07:56 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:57288: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.212
country_id: 6252001
description:
Jan  9 00:09:07 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.177.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9yVUueRHPtAUQbHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-09 00:15:25 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:50570: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-09 00:15:27 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:58762: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:15:35 host2 sshd[853966]: Disconnected from invalid user ubuntu 177.74.188.179 port 45878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-01-09 00:15:09 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:49636: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  9 00:16:43 host2 sshd[854686]: Disconnected from invalid user ubuntu 136.119.213.208 port 37456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-09 00:18:25 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:49092: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Jan  9 00:18:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ObUc2eRHTghChJl3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:20:11 host2 sshd[857240]: Disconnected from invalid user ubuntu 107.173.10.98 port 35312 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:20:18 host2 sshd[857373]: Disconnected from invalid user deploy 177.74.188.179 port 43244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.74.188.179
country_id: 3469034
description:
Jan  9 00:20:55 host2 sshd[857923]: Disconnected from invalid user ubuntu 177.74.188.179 port 54570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 00:22:33 host2 sshd[859087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:22:00 host2 sshd[858736]: Disconnected from invalid user ubuntu 107.173.10.98 port 64670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:22:49 host2 sshd[859264]: Disconnected from invalid user ubuntu 102.211.152.28 port 33780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2026-01-09 00:22:59 dovecot_login authenticator failed for H=([49.125.201.90]) [49.125.201.90]:57934: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 00:23:59 host2 sshd[859991]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  9 00:24:37 host2 sshd[860392]: Disconnected from invalid user test 136.119.213.208 port 48094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:24:03 host2 sshd[860069]: Disconnected from invalid user ubuntu 102.211.152.28 port 41662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Jan  9 00:25:08 host2 sshd[860953]: Disconnected from invalid user deploy 102.211.152.28 port 57550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:26:55 host2 sshd[862518]: Disconnected from invalid user test 107.173.10.98 port 12926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.175
country_id: 2077456
description:
2026-01-09 00:29:09 dovecot_login authenticator failed for H=(ADMIN) [154.16.81.175]:19179: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  9 00:29:23 host2 sshd[864260]: Disconnected from invalid user admin1 107.173.10.98 port 10428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-09 00:29:47 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:55288: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 00:30:07 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:38554: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-09 00:36:45 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:47104: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-01-09 00:37:30 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:52094: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-09 00:37:58 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:43059: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-09 00:38:21 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:39250: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.50
country_id: 2186224
description:
2026-01-09 00:38:29 dovecot_login authenticator failed for H=([121.73.168.50]) [121.73.168.50]:56986: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-09 00:38:35 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (bialetra) [73.176.157.57]:33296: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2026-01-09 00:38:46 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:49470: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2026-01-09 00:40:24 dovecot_login authenticator failed for H=([87.200.93.86]) [87.200.93.86]:58619: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-09 00:40:39 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:54856: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.254
country_id: 6252001
description:
2026-01-09 00:50:50 dovecot_login authenticator failed for H=(ADMIN) [151.241.119.254]:35698: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.119.254
country_id: 6252001
description:
2026-01-09 00:51:05 dovecot_login authenticator failed for H=(ADMIN) [151.241.119.254]:44593: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan  9 00:52:57 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9kUTVuVHoPi4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.82.26
country_id: 6252001
description:
Jan  9 00:55:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.82.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FEJkXeVHnOQ0pVIa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-09 00:56:21 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:34320: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-09 00:56:02 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:54018: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-09 00:56:20 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (inter) [71.224.169.28]:42086: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2026-01-09 01:07:17 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:39689: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-09 01:07:30 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:47058: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.10
country_id: 174982
description:
2026-01-09 01:10:20 dovecot_login authenticator failed for H=(ADMIN) [185.253.160.10]:17498: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 01:11:03 host2 sshd[898477]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.63
country_id: 2186224
description:
2026-01-09 01:12:03 dovecot_login authenticator failed for H=([121.73.169.63]) [121.73.169.63]:42134: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-09 01:12:26 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:49456: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 01:13:38 dovecot_plain authenticator failed for H=(horystoka) [102.53.15.180]:56269: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-09 01:14:19 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:39874: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-09 01:15:14 dovecot_plain authenticator failed for H=(discoggal) [41.248.243.181]:51970: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-09 01:19:55 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:59224: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2026-01-09 01:20:33 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:35684: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-09 01:22:52 dovecot_plain authenticator failed for H=(spelames) [92.62.243.174]:37350: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Jan  9 01:25:40 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.231, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0nwXy+VHV8tb5qjn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.97
country_id: 6252001
description:
Jan  9 01:25:51 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.97, lip=66.85.158.92, TLS: Connection closed, session=<SHq1y+VHDYJb5qhh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.98
country_id: 6252001
description:
Jan  9 01:26:08 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.98, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<5jzEzOVH6btb5qhi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Jan  9 01:26:11 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.231, lip=66.85.158.92, TLS: Connection closed, session=<JKjyzOVHa45b5qjn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.53
country_id: 933860
description:
Jan  9 01:29:27 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.213.53, lip=66.85.158.91, TLS, session=<pkh21+VHaK0p2NU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.231
country_id: 3077311
description:
Jan  9 01:29:44 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.235.7.231, lip=66.85.158.91, TLS, session=<FJGo2OVHNZZt6wfn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-09 01:33:00 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:51572: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-09 01:33:24 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:57282: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2026-01-09 01:33:45 dovecot_login authenticator failed for H=([128.185.247.210]) [182.79.89.14]:50232: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-09 01:34:03 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:45377: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.105.135
country_id: 6252001
description:
Jan  9 01:34:26 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.223.105.135, lip=66.85.158.92, TLS, session=<P1ly6uVHIo2f32mH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-09 01:35:52 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:38852: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-09 01:36:24 dovecot_login authenticator failed for H=([186.235.248.73]) [186.235.248.73]:57874: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-09 01:38:05 dovecot_login authenticator failed for H=([125.19.206.54]) [125.19.206.54]:48786: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.107
country_id: 357994
description:
2026-01-09 01:37:29 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.107]:1066: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.15.194
country_id: 3469034
description:
2026-01-09 01:37:54 dovecot_login authenticator failed for H=([200.195.15.194]) [200.195.15.194]:37614: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.45
country_id: 6252001
description:
Jan  9 01:38:19 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aeBO+OVHF8PG6xgt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan  9 01:40:07 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, session=<jlG9/uVHwH5BMRRF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-09 01:41:57 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (bormingle) [98.227.25.115]:38358: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 01:42:05 host2 pure-ftpd[922187]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-09 01:43:06 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:47290: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-09 01:43:34 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:51778: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-09 01:53:02 dovecot_plain authenticator failed for H=(noggraus) [185.209.108.42]:56310: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.224
country_id: 6252001
description:
Jan  9 01:53:48 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.224, lip=66.85.158.92, session=<01S1L+ZHHbxAPpzg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  9 01:54:00 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, TLS: Connection closed, session=<7vRrMOZHls5APpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  9 01:54:10 host2 dovecot[821886]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, session=<oBYHMeZHJBpAPpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 798549
description:
Jan  9 01:57:23 host2 dovecot[821886]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.149.17, lip=66.85.158.92, TLS, session=<D02APOZHfp9V2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-09 01:57:53 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:40394: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 01:58:03 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:55944: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-09 01:58:04 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:54246: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-09 01:58:14 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:52227: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 01:58:22 dovecot_plain authenticator failed for H=(misre) [76.190.155.43]:45669: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.66
country_id: 2963597
description:
2026-01-09 02:00:55 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.66]:9195: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.66
country_id: 2963597
description:
2026-01-09 02:01:09 dovecot_login authenticator failed for H=(ADMIN) [155.2.194.66]:35738: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 02:03:25 host2 sshd[939350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 02:04:51 host2 sshd[940332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2026-01-09 02:04:59 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:43312: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-09 02:05:33 dovecot_login authenticator failed for H=([186.238.210.226]) [186.238.210.226]:43274: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2026-01-09 02:07:30 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:56087: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-09 02:07:55 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:55172: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-01-09 02:07:19 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [121.202.198.98]:40035: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-09 02:08:32 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:41540: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-09 02:09:50 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (kilimered) [73.196.144.25]:44906: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-09 02:10:10 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:34520: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-09 02:10:36 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [186.238.210.226]:33229: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 02:16:22 host2 sshd[949581]: Disconnected from invalid user user 2.57.121.25 port 37042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.23
country_id: 2589581
description:
2026-01-09 02:17:31 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.23]:38076: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2026-01-09 02:17:47 dovecot_login authenticator failed for H=92.40.62.72.threembb.co.uk [92.40.62.72]:54558: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-09 02:18:37 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:47813: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-09 02:19:51 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:54262: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-09 02:20:04 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:56316: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-09 02:22:50 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:38707: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.235.35.123
country_id: 1269750
description:
2026-01-09 02:23:01 dovecot_login authenticator failed for H=([20.235.35.123]) [20.235.35.123]:48334: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2026-01-09 02:23:41 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:54238: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-09 02:24:21 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:51674: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.209
country_id: 6252001
description:
Jan  9 02:32:30 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.209, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZX4VuuZH17BBMQHR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Jan  9 02:32:51 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<X7tWu+ZHHFhBMQHK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:33:25 host2 pure-ftpd[964580]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:34:56 host2 pure-ftpd[965787]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:35:40 host2 pure-ftpd[966564]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:35:45 host2 pure-ftpd[966636]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-09 02:37:03 dovecot_login authenticator failed for H=([27.123.91.151]) [182.95.124.202]:49912: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.208
country_id: 2510769
description:
2026-01-09 02:37:49 dovecot_login authenticator failed for H=(ADMIN) [212.102.49.208]:43669: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:39:21 host2 pure-ftpd[969348]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Jan  9 02:39:26 host2 pure-ftpd[969413]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-09 02:40:09 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:58532: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-09 02:40:56 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:39926: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Jan  9 02:48:34 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.103, lip=66.85.158.92, session=<aSWR8+ZHsv3G6xhn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-09 02:56:30 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:60122: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2026-01-09 02:56:58 dovecot_login authenticator failed for H=([118.26.153.84]) [118.26.153.84]:19708: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.14
country_id: 146669
description:
2026-01-09 02:58:18 dovecot_login authenticator failed for H=(ADMIN) [185.253.162.14]:49402: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.137
country_id: 3469034
description:
Jan  9 02:59:07 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.245.250.137, lip=66.85.158.91, TLS, session=<Ns04GOdHy42q9fqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.101
country_id: 3175395
description:
Jan  9 02:59:25 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=217.26.179.101, lip=66.85.158.91, TLS, session=<cZBhGedHoozZGrNl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-09 03:02:07 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:60650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-09 03:02:23 dovecot_plain authenticator failed for H=(irlin) [50.202.197.108]:54548: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-01-09 03:02:43 dovecot_login authenticator failed for H=([182.79.151.121]) [27.123.84.54]:52860: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.204
country_id: 6252001
description:
Jan  9 03:11:29 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.204, lip=66.85.158.91, session=<R/CHRedHnaNAPpzM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.78
country_id: 1269750
description:
2026-01-09 03:11:40 dovecot_login authenticator failed for H=([182.95.22.223]) [27.123.104.78]:57176: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Jan  9 03:11:41 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.202, lip=66.85.158.91, TLS: Connection closed, session=<MZpBRudHQIxAPpzK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.173
country_id: 6252001
description:
Jan  9 03:11:55 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4cQTR+dH+6hBMQGt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2026-01-09 03:11:16 dovecot_login authenticator failed for H=([27.123.119.146]) [122.187.172.98]:57614: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-09 03:18:30 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:55200: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-09 03:18:58 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:58614: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-09 03:20:06 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:52560: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-09 03:20:39 dovecot_login authenticator failed for H=([182.95.176.122]) [182.95.176.122]:50452: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-09 03:20:51 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:38177: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-09 03:20:33 dovecot_plain authenticator failed for H=(subbling) [65.20.233.110]:55607: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.15.40.27
country_id: 1643084
description:
[2026-01-09 03:23:40 +0530] info [cpaneld] 157.15.40.27 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-09 03:23:46 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:42682: 535 Incorrect authentication data (set_id=admin@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2026-01-09 03:23:57 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:46497: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.59.18
country_id: 2750405
description:
2026-01-09 03:29:09 dovecot_plain authenticator failed for H=(amile) [128.199.59.18]:54394: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-09 03:31:04 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:58568: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:31:18 host2 sshd[1013169]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-09 03:34:17 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:45316: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2026-01-09 03:34:31 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:12546: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.64
country_id: 3865483
description:
Jan  9 03:35:25 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.124.218.64, lip=66.85.158.91, TLS, session=<IEq+medHo6G6fNpA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-09 03:35:30 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:38558: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.141
country_id: 3469034
description:
Jan  9 03:35:45 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.44.96.141, lip=66.85.158.91, TLS, session=<YFopm+dHLtGxLGCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2026-01-09 03:35:48 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:38037: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-09 03:36:06 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:41944: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Jan  9 03:36:58 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.76, lip=66.85.158.92, TLS, session=<HtifoOdHfPqTuYRM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-01-09 03:36:29 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.41
country_id: 6252001
description:
Jan  9 03:39:45 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.64.106.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VXmTqudHjJoUQGop>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.61
country_id: 3017382
description:
2026-01-09 03:41:19 dovecot_login authenticator failed for H=(ADMIN) [191.101.31.61]:31022: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-09 03:42:58 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (undism) [24.61.199.212]:40768: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2026-01-09 03:43:00 dovecot_login authenticator failed for H=([108.143.69.79]) [108.143.69.79]:49232: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:43:45 host2 sshd[1023435]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-09 03:43:17 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:37052: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-09 03:43:57 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:59596: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-09 03:44:10 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38056: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 98.159.40.140
country_id: 1210997
description:
Jan  9 03:44:29 host2 pure-ftpd[1023946]: (?@98.159.40.140) [INFO] New connection from 98.159.40.140


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.48
country_id: 1831722
description:
Jan  9 03:44:30 host2 pure-ftpd[1023955]: (?@188.215.235.48) [INFO] New connection from 188.215.235.48


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.18
country_id: 2328926
description:
Jan  9 03:44:31 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.65.18, lip=66.85.158.91, TLS, session=<r8Csu+dHip2SRkES>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.254
country_id: 2623032
description:
Jan  9 03:44:32 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.126.94.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uo2uu+dHuO28fl7+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 03:45:10 host2 sshd[1024800]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-09 03:46:13 dovecot_plain authenticator failed for H=(ramphaga) [149.62.239.4]:60960: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 204.76.203.231
country_id: 2750405
description:
Jan  9 03:46:15 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=204.76.203.231, lip=66.85.158.91, session=<C9vUwedH5O3MTMvn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-09 03:49:16 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:36210: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2026-01-09 03:49:34 dovecot_login authenticator failed for H=([111.93.80.158]) [111.93.80.158]:35928: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-01-09 03:53:46 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:52036: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-09 03:53:57 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:33112: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.58
country_id: 3469034
description:
Jan  9 03:54:46 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.216.88.58, lip=66.85.158.91, TLS, session=</d9C3+dHJKm62Fg6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-09 03:54:50 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47932: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-09 03:55:07 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:55810: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.159
country_id: 3865483
description:
Jan  9 03:55:24 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.249.159, lip=66.85.158.91, TLS, session=<9nQs4edHWL2zAPmf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.36
country_id: 6252001
description:
Jan  9 03:59:12 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ULwq8OdH/KcUQcIk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Jan  9 04:02:25 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZMap++dHBOdChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-09 04:05:34 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:54566: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-09 04:05:59 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:33810: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-09 04:06:58 dovecot_plain authenticator failed for H=(gamous) [176.113.155.132]:36606: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.47
country_id: 3017382
description:
Jan  9 04:07:47 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.47, lip=66.85.158.92, TLS: Connection closed, session=<ywvWDuhHa4dbxJgv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.44
country_id: 3017382
description:
Jan  9 04:07:17 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.44, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UiQYDehHz+BbxJgs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.65
country_id: 3017382
description:
Jan  9 04:07:29 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.65, lip=66.85.158.92, TLS: Connection closed, session=<gZvLDehHpedbxJhB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.64
country_id: 3017382
description:
Jan  9 04:07:44 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.64, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<oe6lDuhHN7tbxJhA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.156
country_id: 102358
description:
2026-01-09 04:08:32 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.156]:31184: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-09 04:11:15 dovecot_login authenticator failed for H=([27.123.119.254]) [128.185.246.106]:39060: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.208.139.191
country_id: 2921044
description:
2026-01-09 04:11:34 dovecot_login authenticator failed for H=([94.198.134.241]) [85.208.139.191]:55596: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-09 04:14:48 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:56992: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-01-09 04:20:21 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:49915: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2026-01-09 04:20:52 dovecot_login authenticator failed for H=([45.182.5.96]) [45.182.5.98]:57708: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-09 04:21:55 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:40232: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-09 04:22:12 dovecot_login authenticator failed for H=([184.57.39.170]) [184.57.39.170]:62256: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-09 04:23:59 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:10795: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-09 04:24:29 dovecot_login authenticator failed for H=([72.132.32.143]) [72.132.32.143]:59571: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2026-01-09 04:24:45 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:25671: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-01-09 04:24:12 dovecot_login authenticator failed for H=([128.185.160.185]) [128.185.235.110]:47896: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.194
country_id: 3017382
description:
Jan  9 04:28:23 host2 pure-ftpd[1070572]: (?@91.231.89.194) [INFO] New connection from 91.231.89.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-09 04:29:26 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:45519: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-09 04:30:07 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:58944: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.96
country_id: 3703430
description:
2026-01-09 04:31:16 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.96]:36531: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 04:31:52 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:57953: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-09 04:33:26 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (cogacesban) [68.46.148.180]:34330: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 108.160.128.179
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 108.160.128.179: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:36:44 host2 sshd[1081648]: Disconnected from invalid user test 50.232.189.209 port 59024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:38:19 host2 sshd[1082433]: Disconnected from invalid user admin1 50.232.189.209 port 52574 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Jan  9 04:38:49 host2 sshd[1082700]: Disconnected from invalid user admin1 50.232.189.209 port 35704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-09 04:39:07 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:33498: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.197.7
country_id: 6252001
description:
Jan  9 04:39:29 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.106.197.7, lip=66.85.158.92, TLS, session=<uO0+gOhHsMwUasUH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-09 04:39:59 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:43450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:40:31 host2 sshd[1084030]: Disconnected from invalid user admin1 43.154.195.142 port 57318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:41:08 host2 sshd[1084390]: Disconnected from invalid user admin1 43.154.195.142 port 60722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 04:42:07 host2 sshd[1084983]: Disconnected from invalid user test 151.19.118.27 port 13058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  9 04:42:17 host2 sshd[1085087]: Disconnected from invalid user admin 186.56.11.17 port 36706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Jan  9 04:42:22 host2 sshd[1085146]: Disconnected from invalid user test 43.154.195.142 port 55196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Jan  9 04:42:34 host2 sshd[1085265]: Disconnected from invalid user admin1 187.110.238.50 port 59976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  9 04:43:50 host2 sshd[1086074]: Disconnected from invalid user ubuntu 186.56.11.17 port 34356 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.206.171.113
country_id: 597427
description:
Jan  9 04:44:43 host2 sshd[1086668]: Received disconnect from 85.206.171.113 port 46786:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:45:52 host2 sshd[1088144]: Disconnected from invalid user user 103.147.159.91 port 38946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Jan  9 04:46:01 host2 sshd[1088222]: Disconnected from invalid user user 138.99.80.102 port 43030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Jan  9 04:45:10 host2 sshd[1087328]: Disconnected from invalid user admin1 85.206.171.113 port 36352 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.110.238.50
country_id: 3469034
description:
Jan  9 04:47:28 host2 sshd[1089581]: Disconnected from invalid user deploy 187.110.238.50 port 46520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Jan  9 04:47:41 host2 sshd[1089723]: Disconnected from invalid user ubuntu 138.99.80.102 port 44308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:47:46 host2 sshd[1089789]: Disconnected from invalid user deploy 103.147.159.91 port 39154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2026-01-09 04:49:31 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:39574: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.180.242.106
country_id: 3017382
description:
2026-01-09 04:50:03 dovecot_login authenticator failed for H=(106.242.180.159.in-addr.arpa.celeste.fr) [159.180.242.106]:40178: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2026-01-09 04:50:41 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:42196: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-09 04:50:52 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:60935: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-01-09 04:50:09 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.181]:57098: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-09 04:50:23 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:32799: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.147.159.91
country_id: 1643084
description:
Jan  9 04:51:10 host2 sshd[1092389]: Disconnected from invalid user deploy 103.147.159.91 port 39494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-09 04:51:54 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:40668: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 04:52:54 host2 sshd[1093550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-09 04:52:14 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:48589: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.198.226
country_id: 2510769
description:
Jan  9 04:52:36 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.135.198.226, lip=66.85.158.91, TLS, session=<0loeruhHl4oth8bi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.88
country_id: 3175395
description:
Jan  9 04:52:58 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=217.26.179.88, lip=66.85.158.91, TLS, session=<wWg6r+hHvdrZGrNY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 04:53:19 host2 sshd[1093853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.193
country_id: 294640
description:
2026-01-09 04:53:19 dovecot_login authenticator failed for H=(ADMIN) [149.88.26.193]:46205: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-09 04:55:46 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (nostrosed) [76.157.219.158]:38116: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Jan  9 04:57:23 host2 sshd[1097791]: Disconnected from invalid user admin1 45.120.216.232 port 41112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  9 04:57:25 host2 sshd[1097797]: Disconnected from invalid user user 148.113.24.68 port 56526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.186
country_id: 241170
description:
Jan  9 04:59:08 host2 sshd[1099051]: Disconnected from invalid user user 86.54.42.186 port 57056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.32.246
country_id: 6252001
description:
Jan  9 04:59:51 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.38.32.246, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VmAMyehHCtgUJiD2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  9 05:00:18 host2 sshd[1100221]: Disconnected from invalid user admin 148.113.24.68 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:00:39 host2 sshd[1100668]: Disconnected from invalid user admin 101.36.116.29 port 55154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 05:00:11 host2 sshd[1100113]: Disconnected from invalid user test 151.19.118.27 port 14003 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:01:15 host2 sshd[1101225]: Disconnected from invalid user deploy 101.36.116.29 port 56252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:01:50 host2 sshd[1101653]: Disconnected from invalid user user 101.36.116.29 port 43836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  9 05:02:35 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS: Connection closed, session=<NzbT0uhHcvFChJmB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Jan  9 05:03:13 host2 sshd[1102823]: Disconnected from invalid user admin 147.50.227.79 port 60126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Jan  9 05:04:19 host2 sshd[1103672]: Disconnected from invalid user user1 147.50.227.79 port 52768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-09 05:04:31 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:40997: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 101.36.116.29
country_id: 1819730
description:
Jan  9 05:03:57 host2 sshd[1103353]: Received disconnect from 101.36.116.29 port 34974:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-01-09 05:05:08 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:38964: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.118.27
country_id: 3175395
description:
Jan  9 05:08:13 host2 sshd[1106659]: Disconnected from invalid user admin1 151.19.118.27 port 13139 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-09 05:12:46 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (thealvener) [24.127.53.61]:42688: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2026-01-09 05:14:07 dovecot_login authenticator failed for H=(ADMIN) [143.244.52.64]:45273: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:16:48 host2 sshd[1114369]: Disconnected from invalid user test 205.185.115.224 port 58296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:16:55 host2 sshd[1114436]: Disconnected from invalid user user1 129.226.172.185 port 52036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:17:28 host2 sshd[1114879]: Disconnected from invalid user ubuntu 205.185.115.224 port 41786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Jan  9 05:18:02 host2 sshd[1115330]: Disconnected from invalid user user 205.185.115.224 port 52640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  9 05:18:58 host2 sshd[1115999]: Disconnected from invalid user test 107.155.55.174 port 51514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  9 05:20:11 host2 sshd[1117059]: Disconnected from invalid user user1 107.155.55.174 port 46090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-09 05:20:21 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:34700: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:20:01 host2 sshd[1116726]: Disconnected from invalid user admin 129.226.172.185 port 47272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-09 05:20:08 dovecot_login authenticator failed for H=([41.59.200.166]) [41.59.200.166]:56452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:20:09 host2 sshd[1117010]: Disconnected from invalid user ubuntu 68.183.82.237 port 59392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-09 05:21:40 dovecot_plain authenticator failed for H=(grassishan) [88.207.210.23]:61088: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.172.185
country_id: 1819730
description:
Jan  9 05:21:17 host2 sshd[1117952]: Disconnected from invalid user ubuntu 129.226.172.185 port 42656 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 05:23:52 host2 sshd[1119999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:23:29 host2 sshd[1119749]: Disconnected from invalid user test 68.183.82.237 port 58852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 05:23:40 host2 sshd[1119842]: Disconnected from invalid user user 2.57.121.25 port 26238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-09 05:23:22 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:53270: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-09 05:24:04 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:45775: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:24:31 host2 sshd[1120483]: Disconnected from invalid user user1 68.183.82.237 port 58590 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 05:25:17 host2 sshd[1121214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 68.183.82.237
country_id: 1269750
description:
Jan  9 05:25:02 host2 sshd[1120853]: Received disconnect from 68.183.82.237 port 41476:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2026-01-09 05:26:54 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:34320: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-09 05:27:02 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:39000: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-09 05:27:45 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (linnite) [73.208.81.125]:41672: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:28:44 host2 sshd[1123930]: Disconnected from invalid user deploy 186.31.95.163 port 54184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-09 05:27:54 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:60532: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:29:17 host2 sshd[1124286]: Disconnected from invalid user user1 49.204.74.149 port 48528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:30:44 host2 sshd[1125510]: Disconnected from invalid user user 179.40.112.10 port 42440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:31:25 host2 sshd[1126101]: Disconnected from invalid user ubuntu 179.40.112.10 port 55598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Jan  9 05:32:03 host2 sshd[1126552]: Disconnected from invalid user admin 179.40.112.10 port 40528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-09 05:32:06 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:45678: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-09 05:32:41 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:39554: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:31:57 host2 sshd[1126458]: Disconnected from invalid user admin1 49.204.74.149 port 39880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Jan  9 05:33:08 host2 sshd[1127507]: Disconnected from invalid user user 49.204.74.149 port 33924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:33:28 host2 sshd[1127857]: Disconnected from invalid user user 186.31.95.163 port 58260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  9 05:35:23 host2 sshd[1129380]: Disconnected from invalid user deploy 41.216.177.55 port 41174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.31.95.163
country_id: 3686110
description:
Jan  9 05:35:38 host2 sshd[1129585]: Disconnected from invalid user admin 186.31.95.163 port 52846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  9 05:37:36 host2 sshd[1131097]: Disconnected from invalid user deploy 41.216.177.55 port 50002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-09 05:37:49 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:36660: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.27
country_id: 3865483
description:
2026-01-09 05:39:19 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.27]:14938: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-09 05:39:33 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:52786: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  9 05:41:16 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<4v0xXelHAKOLonHU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.68
country_id: 6252001
description:
Jan  9 05:43:10 host2 pure-ftpd[1135728]: (?@198.235.24.68) [INFO] New connection from 198.235.24.68


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Jan  9 05:44:37 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<mAoiaelH7HmnXpI7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-09 05:45:47 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:42638: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.119.250
country_id: 6252001
description:
Jan  9 05:46:21 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.92.119.250, lip=66.85.158.91, TLS, session=<wd5gb+lHYN6kXHf6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-09 05:46:02 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:58158: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:47:47 host2 sshd[1139675]: Disconnected from invalid user test 23.236.169.235 port 37408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.9.41
country_id: 2921044
description:
Jan  9 05:48:13 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.9.41, lip=66.85.158.91, session=<foANdulHKF+fWQkp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.137.128
country_id: 2921044
description:
Jan  9 05:48:13 host2 dovecot[821886]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.99.137.128, lip=66.85.158.91, session=<cpoCdulHj2mnY4mA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:49:20 host2 sshd[1140810]: Disconnected from invalid user admin 23.236.169.235 port 43256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-09 05:50:06 dovecot_login authenticator failed for H=([178.232.51.135]) [178.232.51.135]:49729: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2026-01-09 05:50:20 dovecot_login authenticator failed for H=([149.54.51.162]) [149.54.51.162]:59790: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.236.169.235
country_id: 6252001
description:
Jan  9 05:50:22 host2 sshd[1141682]: Disconnected from invalid user admin 23.236.169.235 port 37742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:51:09 host2 sshd[1142267]: Disconnected from invalid user user 135.237.122.43 port 32888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  9 05:52:27 host2 sshd[1143445]: Disconnected from invalid user test 82.24.64.209 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  9 05:51:59 host2 sshd[1142957]: Disconnected from invalid user test 82.24.64.209 port 59636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:53:17 host2 sshd[1144194]: Disconnected from invalid user test 135.237.122.43 port 42172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.237.122.43
country_id: 6252001
description:
Jan  9 05:53:48 host2 sshd[1144536]: Disconnected from invalid user ubuntu 135.237.122.43 port 54886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  9 05:57:12 host2 dovecot[821886]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<sssBlulHFtzE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.195.52.4
country_id: 3144096
description:
2026-01-09 05:58:01 dovecot_login authenticator failed for H=([141.195.52.4]) [141.195.52.4]:48916: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Jan  9 05:58:47 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<WGTZm+lHIn9ChJl9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  9 06:00:41 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<yEWboulH5I2LonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 06:04:46 dovecot_plain authenticator failed for H=(hallation) [102.53.15.180]:39195: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.170
country_id: 3144096
description:
2026-01-09 06:05:51 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.170]:56316: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-09 06:08:05 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:37882: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-09 06:09:03 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:47595: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-09 06:10:14 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:37246: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2026-01-09 06:10:51 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:40126: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2026-01-09 06:11:19 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:59149: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2026-01-09 06:12:30 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:55631: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-09 06:13:03 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:42639: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-09 06:14:15 dovecot_plain authenticator failed for H=(oxinted) [65.20.129.67]:44845: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-09 06:16:41 dovecot_plain authenticator failed for H=(mindik) [90.160.139.163]:38159: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.194
country_id: 953987
description:
Jan  9 06:18:28 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.64.42.194, lip=66.85.158.91, TLS, session=<LzgK4elHluZmQCrC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2026-01-09 06:17:45 dovecot_login authenticator failed for H=([213.230.64.246]) [213.230.64.246]:42746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-09 06:18:14 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:59980: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.60
country_id: 3469034
description:
Jan  9 06:19:02 host2 dovecot[821886]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=187.120.73.60, lip=66.85.158.91, TLS, session=<LdAI4+lHTZy7eEk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 06:21:22 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:42598: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-09 06:21:49 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:34864: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-09 06:22:13 dovecot_login authenticator failed for H=([125.18.67.17]) [182.95.112.146]:46406: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-09 06:22:48 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:49071: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 43.241.36.24 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 06:33:11 host2 dovecot[821886]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.92, session=<01XeFupHdL5ChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-09 06:34:01 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37490: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.35
country_id: 617790
description:
2026-01-09 06:33:40 dovecot_login authenticator failed for H=(ADMIN) [178.175.128.35]:13395: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-09 06:34:52 dovecot_login authenticator failed for H=([182.95.197.193]) [182.79.87.18]:48458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-09 06:36:25 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:33949: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-09 06:42:16 dovecot_plain authenticator failed for H=(jauming) [41.248.243.181]:44292: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.4
country_id: 3469034
description:
Jan  9 06:42:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.4, lip=66.85.158.91, TLS, session=<90xYOOpHwOe+WYkE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Jan  9 06:43:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<Ib73OepHXqCxgqgd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.242
country_id: 3469034
description:
Jan  9 06:45:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=187.120.76.242, lip=66.85.158.91, TLS, session=<Bs5gQepHI627eEzy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.229
country_id: 3865483
description:
Jan  9 06:45:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.249.229, lip=66.85.158.91, TLS, session=<XSK4QupHjMazAPnl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-09 06:48:32 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:51632: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-09 06:48:46 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:30792: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-09 06:49:06 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:49652: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-09 06:49:42 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:43668: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-01-09 06:53:33 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:34310: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.212
country_id: 6252001
description:
Jan  9 06:55:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.185.212, lip=66.85.158.91, session=<vFJAaOpHBpgofLnU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.99
country_id: 1831722
description:
2026-01-09 06:57:08 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.99]:1926: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-09 07:03:51 dovecot_plain authenticator failed for H=(toins) [65.20.149.93]:52435: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Jan  9 07:06:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=<jsD6jupHLK2nXpIx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-09 07:07:01 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:57620: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Jan  9 07:06:49 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, session=<E4cZj+pHZq2nXpIx>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.28
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.28: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.115.152
country_id: 1269750
description:
2026-01-09 07:17:03 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.115.152]:58735: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-09 07:17:13 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:35358: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-09 07:17:30 dovecot_login authenticator failed for H=([223.197.145.33]) [223.197.145.33]:60578: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-09 07:18:33 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:39042: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.121
country_id: 798544
description:
Jan  9 07:19:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=91.240.44.121, lip=66.85.158.91, TLS, session=<2ykMu+pHlr5b8Cx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.39.38
country_id: 226074
description:
Jan  9 07:19:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=196.0.39.38, lip=66.85.158.91, TLS, session=<ZMYQu+pH8JjEACcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Jan  9 07:19:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<W3TwuepHNoYfs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.70
country_id: 732800
description:
Jan  9 07:19:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.70, lip=66.85.158.91, TLS, session=<BrrkuepH5Oe5/9RG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-09 07:19:14 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:61259: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-09 07:21:40 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:45079: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.169.56.221
country_id: 1643084
description:
2026-01-09 07:21:17 dovecot_login authenticator failed for H=([202.169.56.221]) [202.169.56.221]:33012: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-09 07:22:59 dovecot_plain authenticator failed for H=(hallus) [64.72.74.162]:59215: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.165
country_id: 2960313
description:
2026-01-09 07:24:56 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.165]:48710: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-09 07:25:34 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:51275: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-09 07:25:54 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:49555: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.165
country_id: 2960313
description:
2026-01-09 07:27:49 dovecot_login authenticator failed for H=(ADMIN) [37.46.113.165]:46814: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 07:28:29 host2 sshd[1221630]: Disconnected from invalid user admin 2.57.121.112 port 10092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 07:30:31 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:37592: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-09 07:30:40 dovecot_login authenticator failed for H=(syn-075-183-106-192.res.spectrum.com) [75.183.106.192]:48935: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WvHG6upHdBVAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  9 07:32:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<9Aad7OpHpF1APpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-09 07:34:04 dovecot_login authenticator failed for H=(14.140.218.210.static-bangalore-vsnl.net.in) [14.140.218.210]:53587: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:34:36 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:45396: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Jan  9 07:43:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.219, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EMLnE+tHMbNb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.28
country_id: 3017382
description:
Jan  9 07:44:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.28, lip=66.85.158.91, TLS: Connection closed, session=<lIqHFOtHhZpb51kc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.218
country_id: 3017382
description:
Jan  9 07:44:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.218, lip=66.85.158.91, TLS: Connection closed, session=<dPh1FetHp9Vb51na>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-09 07:46:30 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:34608: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2026-01-09 07:46:06 dovecot_login authenticator failed for H=128.27.155.104.bc.googleusercontent.com [104.155.27.128]:56125: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.45
country_id: 2921044
description:
2026-01-09 07:47:20 dovecot_login authenticator failed for H=(ADMIN) [45.88.97.45]:24357: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-09 07:47:31 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:49707: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-09 07:46:52 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:56859: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-09 07:47:55 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:42376: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.179
country_id: 3017382
description:
Jan  9 07:48:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.179, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mmm6I+tH4apbxJiz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.183
country_id: 3017382
description:
Jan  9 07:48:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.183, lip=66.85.158.91, TLS: Connection closed, session=<171aJOtH88lbxJi3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.210
country_id: 3017382
description:
Jan  9 07:48:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.210, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<TxQmJetHc5pbxJjS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.215
country_id: 3017382
description:
Jan  9 07:48:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.215, lip=66.85.158.91, TLS: Connection closed, session=<0EFWJetHcdVbxJjX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:15 host2 sshd[1238254]: Disconnected from invalid user admin1 13.73.111.251 port 43156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:50:53 host2 sshd[1238693]: Disconnected from invalid user ubuntu 13.73.111.251 port 54838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  9 07:52:15 host2 sshd[1239772]: Disconnected from invalid user user1 13.73.111.251 port 48340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 07:54:00 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (plized) [174.166.153.20]:43622: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-09 07:53:56 dovecot_plain authenticator failed for H=(crohan) [50.217.40.11]:59830: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-09 07:56:00 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:41604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2026-01-09 07:56:20 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:52126: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-09 08:03:44 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61613: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-09 08:06:57 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:45505: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-09 08:09:39 dovecot_login authenticator failed for H=([85.152.57.60]) [85.152.57.60]:43196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2026-01-09 08:10:12 dovecot_login authenticator failed for H=([117.205.2.9]) [117.205.2.9]:35622: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-09 08:10:35 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:51526: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-01-09 08:10:55 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:48670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.75.2
country_id: 6252001
description:
Jan  9 08:13:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.75.2, lip=66.85.158.92, session=<sxg4futHCq0UDksC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.147
country_id: 6252001
description:
2026-01-09 08:14:54 dovecot_login authenticator failed for H=(ADMIN) [181.214.165.147]:51396: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:15:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MUVZg+tH4tWi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<j/y0hutHiPSi2JbM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  9 08:17:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<bc/KiutH4H1ChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:16:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<03v1ietHLOai2JbM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.226.241
country_id: 290291
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.226.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 08:19:08 dovecot_plain authenticator failed for H=(nially) [102.53.15.180]:58698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-09 08:20:36 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:41618: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.221.68
country_id: 2510769
description:
2026-01-09 08:21:15 dovecot_login authenticator failed for H=68.red-79-154-221.dynamicip.rima-tde.net [79.154.221.68]:43919: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-09 08:23:09 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:35165: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-09 08:23:46 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:39313: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-09 08:23:59 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:34915: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.204
country_id: 6252001
description:
Jan  9 08:24:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.204, lip=66.85.158.91, TLS, session=<lcBFo+tH0Oei2JbM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-09 08:24:28 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:56768: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-09 08:25:09 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:44782: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-09 08:25:34 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:56698: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-09 08:25:41 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:49820: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 08:26:07 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:45010: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:27:40 host2 sshd[1267977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.169.18.6
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 62.169.18.6: 465 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:32:02 host2 sshd[1271883]: Disconnected from invalid user admin1 5.29.135.63 port 44056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-09 08:32:58 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (unble) [68.82.141.145]:52744: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Jan  9 08:33:10 host2 sshd[1272815]: Disconnected from invalid user user 5.29.135.63 port 57818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-09 08:33:23 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (augnated) [68.40.189.43]:60798: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-09 08:38:27 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64768: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.70
country_id: 6252001
description:
Jan  9 08:38:34 host2 pure-ftpd[1277003]: (?@20.118.209.70) [INFO] New connection from 20.118.209.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-09 08:39:08 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:60412: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 08:41:53 host2 sshd[1279797]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.105.135
country_id: 3865483
description:
Jan  9 08:41:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.238.105.135, lip=66.85.158.91, TLS, session=<4+EX4utHF8Et7mmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.50
country_id: 3469034
description:
Jan  9 08:42:17 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.39.142.50, lip=66.85.158.91, TLS, session=<M5B14+tH8Z2xJ44y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2026-01-09 08:43:23 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se [155.4.72.204]:56021: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-09 08:43:13 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:35378: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-09 08:45:02 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (brime) [98.40.101.10]:54584: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.185.206
country_id: 6252001
description:
Jan  9 08:46:32 host2 pure-ftpd[1284550]: (?@40.124.185.206) [INFO] New connection from 40.124.185.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 08:48:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (overaps) [87.103.126.54]:19227: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Jan  9 08:48:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.123, lip=66.85.158.91, session=<URIY/OtHcvWTuYR7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-09 08:52:30 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:38062: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-09 08:53:22 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:50282: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-09 08:53:46 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:45192: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-09 08:53:56 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:60356: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-09 08:57:09 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:51236: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Jan  9 08:57:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XwZTG+xHCM/G6xjJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2026-01-09 08:56:51 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:45093: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.12
country_id: 2186224
description:
2026-01-09 08:58:19 dovecot_login authenticator failed for H=([121.73.168.12]) [121.73.168.12]:40402: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-09 08:57:52 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:41254: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-09 08:59:39 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (fresings) [81.226.88.121]:59224: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-09 09:00:28 dovecot_plain authenticator failed for H=(maimbols) [38.248.111.238]:38461: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  9 09:00:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<hGoCJ+xH5pmSvhb3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.233.5.67
country_id: 6252001
description:
2026-01-09 09:02:24 dovecot_login authenticator failed for H=([50.233.5.67]) [50.233.5.67]:45561: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-09 09:02:37 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:51567: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.48.131
country_id: 2750405
description:
2026-01-09 09:05:02 dovecot_login authenticator failed for H=(ADMIN) [212.56.48.131]:58092: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-09 09:06:27 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (crantly) [73.196.144.25]:55994: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-09 09:09:20 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:53162: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-09 09:09:08 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:54744: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:15:26 host2 sshd[1312257]: Disconnected from invalid user ubuntu 109.241.24.186 port 36368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-09 09:16:11 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:34891: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:27 host2 sshd[1313100]: Disconnected from invalid user ubuntu 43.157.2.238 port 42612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-09 09:16:38 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:38770: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.2.238
country_id: 2921044
description:
Jan  9 09:16:56 host2 sshd[1313398]: Disconnected from invalid user deploy 43.157.2.238 port 47776 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:16:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4jWqYOxHmMYDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:17:18 host2 sshd[1313663]: Disconnected from invalid user admin 109.241.24.186 port 52964 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:18:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XIqxZOxHSroDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-09 09:18:49 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:45289: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2026-01-09 09:19:03 dovecot_login authenticator failed for H=(nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:47112: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:18:26 host2 sshd[1314509]: Disconnected from invalid user user 109.241.24.186 port 39172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:20:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<niqHa+xH0u0DjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.241.24.186
country_id: 798544
description:
Jan  9 09:20:09 host2 sshd[1315911]: Disconnected from invalid user test 109.241.24.186 port 58566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Jan  9 09:20:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ntzCbuxHO9PN0h/G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:22:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q4OqdexHgoQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 09:23:22 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:58102: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:23:31 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YI4DeOxHXKsDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-09 09:23:38 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:52554: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  9 09:25:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=</Gerf+xHFIEDjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.81.126
country_id: 1880251
description:
Jan  9 09:27:57 host2 pure-ftpd[1322213]: (?@47.245.81.126) [INFO] New connection from 47.245.81.126


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2026-01-09 09:29:08 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.10]:38380: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 09:28:47 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (puradisfic) [73.213.237.28]:53622: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


