# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:36:49 host2 sshd[3162202]: Disconnected from invalid user ftpuser 201.76.120.30 port 38252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:37:35 host2 sshd[3162688]: Disconnected from invalid user admin 201.76.120.30 port 50160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:39:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zbVSFIBG5M4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-22 06:40:45 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:55999: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-22 06:42:13 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:37398: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.114.67
country_id: 798544
description:
Dec 22 06:41:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=155.133.114.67, lip=66.85.158.91, TLS, session=<CLpZGoBG7I6bhXJD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 06:41:28 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:46016: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-22 06:41:33 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:43980: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:41:58 host2 sshd[3166312]: Disconnected from invalid user docker 138.197.31.20 port 60622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-12-22 06:41:58 dovecot_login authenticator failed for H=([200.195.67.82]) [200.195.67.82]:49994: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-22 06:41:25 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:59289: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:41:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<zm1KHIBG3usDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.148
country_id: 732800
description:
Dec 22 06:41:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.212.148, lip=66.85.158.91, TLS, session=<m/VsG4BGtYi5/9SU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.202.82.102
country_id: 1861060
description:
2025-12-22 06:41:49 dovecot_login authenticator failed for H=fp5cca5266.gifg408.ap.nuro.jp [92.202.82.102]:22450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:42:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6+9LH4BGht8DgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:43:07 host2 sshd[3167098]: Disconnected from invalid user bot1 138.197.31.20 port 37976 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:43:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dRIKI4BGxJ4DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:43:53 host2 sshd[3167867]: Disconnected from invalid user developer 138.197.31.20 port 37678 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-22 06:45:21 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:50480: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-22 06:45:21 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:57898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:45:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<u9/3KoBGXMkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-22 06:45:53 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:58536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-22 06:46:09 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:35799: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-22 06:46:11 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:56682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-22 06:45:27 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:34920: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-22 06:45:41 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:37833: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-22 06:45:50 dovecot_login authenticator failed for H=([149.54.51.162]) [149.54.51.162]:51527: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-22 06:46:36 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:47661: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:49:06 host2 sshd[3172138]: Disconnected from invalid user ubuntu 118.193.43.167 port 28276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:51:45 host2 sshd[3174131]: Disconnected from invalid user test1 36.91.81.195 port 36596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:51:27 host2 sshd[3173973]: Disconnected from invalid user k8s 118.193.43.167 port 13624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:52:35 host2 sshd[3174697]: Disconnected from invalid user ldap 118.193.43.167 port 38286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:54:11 host2 sshd[3175978]: Disconnected from invalid user es 36.91.81.195 port 55460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.186
country_id: 3144096
description:
2025-12-22 06:53:29 dovecot_login authenticator failed for H=([127.0.0.1]) [62.97.161.186]:53254: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:53:46 host2 sshd[3175469]: Disconnected from invalid user ubuntu 118.193.43.167 port 62948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-22 06:53:51 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:16056: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:55:21 host2 sshd[3177080]: Disconnected from invalid user user10 36.91.81.195 port 50780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-22 06:56:34 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.58.18]:40418: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2025-12-22 06:56:41 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se ([127.0.0.1]) [155.4.72.204]:47418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-22 06:57:02 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (maized) [73.213.237.28]:33150: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Dec 22 06:58:07 host2 sshd[3179166]: Disconnected from invalid user morteza 78.89.154.59 port 57308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 22 06:57:20 host2 sshd[3178573]: Disconnected from invalid user sysadmin 78.89.154.59 port 36386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:57:47 host2 sshd[3178847]: Disconnected from invalid user ubuntu 36.91.81.195 port 41410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-22 06:59:28 dovecot_plain authenticator failed for H=(subily) [65.20.233.110]:41215: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 07:00:06 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (syncial) [87.103.126.54]:40193: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-22 07:00:22 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:57929: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.241.4
country_id: 290557
description:
2025-12-22 07:00:47 dovecot_login authenticator failed for H=([98.98.241.4]) [98.98.241.4]:36293: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-22 07:01:04 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:52818: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-22 07:02:47 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:38078: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-22 07:03:04 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:59813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 07:06:30 host2 sshd[3185910]: Disconnected from invalid user user 2.57.121.25 port 7165 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-22 07:15:59 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (irowed) [73.213.236.66]:50748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-22 07:16:03 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (bathiess) [174.166.153.20]:57776: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-22 07:16:12 dovecot_plain authenticator failed for H=(onrancet) [199.192.123.12]:45942: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-22 07:20:02 dovecot_plain authenticator failed for H=(behomen) [65.20.233.110]:53065: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-22 07:27:05 dovecot_plain authenticator failed for H=(micaplace) [94.206.93.90]:47279: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 07:27:40 host2 pure-ftpd[3206074]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-22 07:28:37 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:54508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 07:28:54 dovecot_login authenticator failed for H=(223-30-0-0.lan.sify.net) [136.232.73.130]:52534: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-22 07:31:05 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:55880: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-22 07:32:00 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:33020: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.162.254
country_id: 6252001
description:
Dec 22 07:33:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.235.162.254, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Ed651oBGaJ5K66L+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 22 07:34:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, session=<Kocz2oBGyORAPpxs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 22 07:35:16 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, session=<2C7C24BGjP5APpxs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.164
country_id: 2635167
description:
Dec 22 07:35:26 host2 pure-ftpd[3213184]: (?@87.236.176.164) [INFO] New connection from 87.236.176.164


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Dec 22 07:36:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.92, TLS, session=<9Yus4YBGMvLG6xjo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.166
country_id: 6252001
description:
Dec 22 07:40:13 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.104.166, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Uhtv7YBGrM+symim>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 07:41:29 host2 sshd[3218379]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Dec 22 07:41:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<nbMm8oBGfrQD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 22 07:47:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<OnoHCIFGVog2xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.165
country_id: 6252001
description:
Dec 22 07:49:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wtT4D4FGIdKTuYSl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 07:51:36 host2 sshd[3227266]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-22 07:52:42 dovecot_login authenticator failed for H=([152.52.92.105]) [152.52.192.74]:34752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-22 07:52:54 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:50662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 08:03:05 host2 sshd[3240046]: Disconnected from invalid user kameron 62.60.131.157 port 60406 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.32
country_id: 2750405
description:
Dec 22 08:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, TLS, session=<ZO1dP4FG6oFWNh8g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 2750405
description:
Dec 22 08:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<p85nP4FGvIpWNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-22 08:05:46 dovecot_login authenticator failed for H=([125.19.163.58]) [125.19.163.58]:59076: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-22 08:06:00 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:37480: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-22 08:08:24 dovecot_login authenticator failed for H=([154.208.47.13]) [154.208.47.13]:51582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-22 08:08:39 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:38580: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 08:11:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<cRJ7W4FGeITBHmEh>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:34 host2 sshd[3253275]: Disconnecting authenticating user root 176.235.182.73 port 42003: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:45 host2 sshd[3253531]: error: maximum authentication attempts exceeded for invalid user admin from 176.235.182.73 port 44903 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:48 host2 sshd[3253588]: Disconnecting invalid user admin 176.235.182.73 port 45603: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:34 host2 sshd[3253275]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 42003 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 08:15:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (statip) [87.103.126.54]:65031: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-22 08:19:05 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:38662: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.129
country_id: 2186224
description:
2025-12-22 08:19:18 dovecot_login authenticator failed for H=([121.73.168.129]) [121.73.168.129]:54078: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 08:19:24 host2 sshd[3260406]: Disconnected from invalid user admin 2.57.121.112 port 21137 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.168.241.57
country_id: 798544
description:
Dec 22 08:22:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=193.168.241.57, lip=66.85.158.91, TLS, session=<qJbygoFGL67BqPE5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.119.120.223
country_id: 798544
description:
Dec 22 08:22:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.119.120.223, lip=66.85.158.91, TLS, session=<HMzbgYFGUd65d3jf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-22 08:24:11 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (fisaler) [24.127.53.61]:39822: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-22 08:26:11 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:63795: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.7
country_id: 3175395
description:
Dec 22 08:29:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.170.7, lip=66.85.158.91, TLS, session=<Z+FPnYFG5au5D6oH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.95
country_id: 3865483
description:
Dec 22 08:30:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.1.224.95, lip=66.85.158.91, TLS, session=<sL12noFGaq+6AeBf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 08:30:20 host2 pure-ftpd[3270251]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-22 08:31:38 +0530] info [cpaneld] 139.59.46.198 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:33:02 host2 sshd[3272714]: Disconnected from invalid user vikas 142.93.126.22 port 47692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.121.114.97
country_id: 2589581
description:
2025-12-22 08:34:50 dovecot_plain authenticator failed for H=(BLQ8UWWR76TP98) [154.121.114.97]:35967: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.121.114.97
country_id: 2589581
description:
2025-12-22 08:34:56 dovecot_login authenticator failed for H=(BLQ8UWWR76TP98) [154.121.114.97]:35967: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:35:09 host2 sshd[3274543]: Disconnected from invalid user rdp 45.172.152.74 port 51154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 08:36:55 host2 sshd[3275882]: Disconnected from invalid user raina 62.60.131.157 port 54068 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.243
country_id: 6252001
description:
Dec 22 08:38:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.243, lip=66.85.158.91, session=<lxLUvIFGgdlb5qjz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.241
country_id: 6252001
description:
Dec 22 08:38:36 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.241, lip=66.85.158.91, session=<xJU8voFGOddb5qjx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:38:43 host2 sshd[3277255]: Disconnected from invalid user rust 142.93.126.22 port 32910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:39:21 host2 sshd[3277901]: Disconnected from invalid user ali 45.172.152.74 port 53958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:39:24 host2 sshd[3277925]: Disconnected from invalid user rdp 103.226.139.139 port 39040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:39:47 host2 sshd[3278238]: Disconnected from invalid user deploy 142.93.126.22 port 45366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:39:57 host2 sshd[3278369]: Disconnected from invalid user matt 45.172.152.74 port 51594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-22 08:40:20 dovecot_plain authenticator failed for H=(ometers) [65.20.191.12]:59903: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:40:45 host2 sshd[3279241]: Disconnected from invalid user steamcmd 103.226.139.139 port 34928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:40:47 host2 sshd[3279281]: Disconnected from invalid user git 142.93.126.22 port 56898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:41:56 host2 sshd[3280190]: Disconnected from invalid user dev 103.226.139.139 port 59052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:43:21 host2 sshd[3281596]: Disconnected from invalid user deploy 45.172.152.74 port 37078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:43:55 host2 sshd[3282072]: Disconnected from invalid user dev 45.172.152.74 port 58556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:44:28 host2 sshd[3282604]: Disconnected from invalid user user2 103.226.139.139 port 50838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:45:05 host2 sshd[3283364]: Disconnected from invalid user mohammad 103.226.139.139 port 34668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-22 08:47:03 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:44422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 08:47:31 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:60678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 08:49:05 host2 sshd[3287915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Dec 22 08:50:16 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.86, lip=66.85.158.91, session=<h+T054FGePLN0h9W>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-22 08:51:00 dovecot_login authenticator failed for H=(cm-178.232.111.229.get.no) [178.232.111.229]:36107: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.148.44.92
country_id: 2077456
description:
2025-12-22 08:53:08 dovecot_login authenticator failed for H=ip-206-148-44-92.internet.url.net.au [206.148.44.92]:38237: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-22 08:53:41 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:38674: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:00:43 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GdRLDYJG/saTuYVf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 22 09:00:48 host2 sshd[3298542]: Disconnected from invalid user pratik 177.53.215.134 port 58996 [preauth]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:38 host2 pure-ftpd[3299220]: (?@171.4.232.131) [WARNING] Authentication failed for user [smtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:01:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CWt0DoJGgumTuYVf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:33 host2 sshd[3299219]: Invalid user smtp.zoho.com587hr@lezzarotech.com from 171.4.232.131 port 53676


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:31 host2 pure-ftpd[3299220]: (?@171.4.232.131) [INFO] New connection from 171.4.232.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-22 09:02:14 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:53822: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 22 09:02:30 host2 sshd[3300002]: Disconnected from invalid user httpd 177.53.215.134 port 38726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-22 09:02:42 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:55699: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:02:54 host2 sshd[3300255]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.52
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EeVRFYJGM9stnIA0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-22 09:03:20 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:59234: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.51
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.51, lip=66.85.158.92, TLS, session=<KshIFYJGMJ8tnIAz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.52
country_id: 2264397
description:
Dec 22 09:02:56 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.52, lip=66.85.158.92, TLS, session=<hpNEFYJGM94tnIA0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.53
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.53, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V/ZWFYJGb44tnIA1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2025-12-22 09:02:58 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.170]:56745: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.54
country_id: 2264397
description:
Dec 22 09:03:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.54, lip=66.85.158.92, TLS, session=<AvOFFYJG7ZQtnIA2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2025-12-22 09:04:53 +0530] info [cpaneld] 217.172.189.13 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 22 09:06:24 host2 sshd[3303284]: Disconnected from invalid user qa 118.194.250.11 port 35412 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:05:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS, session=<PqXkH4JGXOqTuYVf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2025-12-22 09:08:35 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:49369: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-22 09:08:55 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:50702: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 22 09:10:35 host2 sshd[3306840]: Disconnected from invalid user proxyuser 118.194.250.11 port 33458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 22 09:13:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.171.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ywKfOoJGcNOkXKuE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.74.18
country_id: 1269750
description:
2025-12-22 09:14:47 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [106.76.74.18]:5420: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-22 09:14:48 dovecot_plain authenticator failed for H=(copoly) [12.150.243.22]:23195: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.74.18
country_id: 1269750
description:
2025-12-22 09:14:54 dovecot_login authenticator failed for H=(7J2Z8VH88YREWO) [106.76.74.18]:5420: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.5
country_id: 798549
description:
Dec 22 09:15:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.5, lip=66.85.158.91, session=<pTpyQYJGkIvUSZQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-12-22 09:17:20 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:60636: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-22 09:17:44 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:47662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:19:12 host2 sshd[3313721]: Disconnected from invalid user bot1 34.85.163.94 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:21:05 host2 sshd[3315623]: Disconnected from invalid user max 34.85.163.94 port 58380 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:21:46 host2 sshd[3316094]: Disconnected from invalid user benoit 34.85.163.94 port 47178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-22 09:22:20 dovecot_login authenticator failed for H=(189.218.82.49-clientes-izzi.mx) [189.218.82.49]:33988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-22 09:22:48 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:37947: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:23:12 host2 sshd[3317139]: Disconnected from invalid user gaurav 34.85.163.94 port 54032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:23:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VSIcX4JGlNaTuYWd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:24:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZyyQYoJGhOiTuYWd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 09:24:43 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:39553: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-22 09:24:13 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:36318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-22 09:25:06 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:40492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:25:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<pF9/ZIJGvueTuYWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.119.109
country_id: 3865483
description:
Dec 22 09:25:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=190.181.119.109, lip=66.85.158.91, TLS, session=<v9YEZIJGLMW+tXdt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.162
country_id: 3469034
description:
Dec 22 09:25:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=191.53.129.162, lip=66.85.158.91, TLS, session=<VgQyZYJG+LS/NYGi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:25:59 host2 sshd[3319497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 22 09:26:25 host2 pure-ftpd[3319947]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 09:27:29 host2 sshd[3320656]: Disconnected from invalid user user 2.57.121.25 port 52111 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-22 09:28:00 dovecot_plain authenticator failed for H=(nonanine) [65.20.129.28]:44836: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-22 09:28:48 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:48646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-22 09:28:02 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:45198: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.111
country_id: 6252001
description:
Dec 22 09:28:58 host2 pure-ftpd[3322162]: (?@195.184.76.111) [INFO] New connection from 195.184.76.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.174.206.114
country_id: 6252001
description:
[2025-12-22 09:29:00 +0530] info [cpaneld] 72.174.206.114 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.249.41.23
country_id: 6252001
description:
[2025-12-22 09:29:03 +0530] info [cpaneld] 47.249.41.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.29.200
country_id: 6252001
description:
[2025-12-22 09:29:08 +0530] info [whostmgrd] 35.151.29.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.205.191
country_id: 6252001
description:
[2025-12-22 09:29:13 +0530] info [cpaneld] 74.141.205.191 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.216
country_id: 3017382
description:
Dec 22 09:29:21 host2 pure-ftpd[3322561]: (?@91.231.89.216) [INFO] New connection from 91.231.89.216


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.24
country_id: 6252001
description:
Dec 22 09:28:58 host2 pure-ftpd[3322158]: (?@195.184.76.24) [INFO] New connection from 195.184.76.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.17.125
country_id: 6252001
description:
[2025-12-22 09:29:04 +0530] info [cpaneld] 172.56.17.125 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.117.134.16
country_id: 6252001
description:
[2025-12-22 09:29:11 +0530] info [cpaneld] 70.117.134.16 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.127.229.205
country_id: 6252001
description:
[2025-12-22 09:29:14 +0530] info [cpaneld] 70.127.229.205 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:31:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS, session=<BmZ2fIJGeP2TuYWd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:32:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS, session=<89dSfYJGZuSTuYWd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-22 09:32:02 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:38236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 09:32:49 host2 pure-ftpd[3326445]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.118.66
country_id: 1269750
description:
2025-12-22 09:32:58 dovecot_plain authenticator failed for H=(GXA8DC) [49.204.118.66]:41447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:36:06 host2 sshd[3329837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-22 09:40:16 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net ([127.0.0.1]) [189.203.180.173]:34322: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-22 09:40:23 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.148.129]:49711: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-22 09:41:03 dovecot_login authenticator failed for H=(ipv4-124-186-245-43.as55666.net) [43.245.186.121]:34496: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-22 09:41:31 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:51752: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 09:41:37 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:53658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-22 09:40:59 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:60680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.24
country_id: 1269750
description:
Dec 22 09:43:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.8.118.24, lip=66.85.158.91, TLS, session=<PW9to4JGsMRnCHYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.205
country_id: 798544
description:
Dec 22 09:43:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.216.29.205, lip=66.85.158.91, TLS, session=<5Tq7pIJGUOKy2B3N>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 09:44:24 host2 sshd[3338910]: Disconnected from invalid user dayna 62.60.131.157 port 64701 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.173
country_id: 298795
description:
2025-12-22 10:00:56 dovecot_login authenticator failed for H=([5.11.168.173]) [5.11.168.173]:51726: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2025-12-22 10:02:41 dovecot_plain authenticator failed for H=host-188-11-17-169.business.telecomitalia.it (ulostotic) [188.11.17.169]:57714: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 10:02:31 host2 sshd[3355810]: Disconnected from invalid user user 2.57.121.25 port 16221 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-22 10:02:35 dovecot_plain authenticator failed for H=(bemis) [65.20.148.194]:47929: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-22 10:16:07 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (prepwooft) [68.40.189.43]:45644: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.15.180.31
country_id: 6252001
description:
Dec 22 10:17:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.15.180.31, lip=66.85.158.91, session=<z/AdH4NGrsoDD7Qf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.172.46
country_id: 6252001
description:
Dec 22 10:17:08 host2 sshd[3367477]: Invalid user cloudtourssrilan_travel from 159.65.172.46 port 54300


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 10:17:56 host2 sshd[3368078]: Disconnected from invalid user katy 62.60.131.157 port 42463 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-22 10:18:25 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (parifil) [73.168.136.150]:57552: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-22 10:20:14 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (taffinely) [73.168.136.150]:36282: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.172.46
country_id: 6252001
description:
Dec 22 10:21:27 host2 sshd[3370990]: Invalid user cloudtourssrilan_travel from 159.65.172.46 port 60368


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.179.34
country_id: 1880251
description:
Dec 22 10:23:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact>, method=PLAIN, rip=188.166.179.34, lip=66.85.158.91, session=<a03CNING2sW8prMi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.99.14
country_id: 290557
description:
Dec 22 10:23:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=5.32.99.14, lip=66.85.158.91, TLS, session=<3vBfNINGy8kFIGMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.239.45.10
country_id: 1269750
description:
Dec 22 10:23:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.239.45.10, lip=66.85.158.91, TLS, session=<e3/0MoNGeuN17y0K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.22.218
country_id: 290557
description:
Dec 22 10:23:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=5.32.22.218, lip=66.85.158.91, TLS, session=<91cbM4NGBJwFIBba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.22.218
country_id: 290557
description:
Dec 22 10:24:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact>, method=PLAIN, rip=5.32.22.218, lip=66.85.158.91, session=<Y5n9NoNGhq8FIBba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.114.140.70
country_id: 3469034
description:
Dec 22 10:24:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=189.114.140.70, lip=66.85.158.91, TLS, session=<Ku5JN4NGH9K9coxG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 10:24:54 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nesman) [87.103.126.54]:25033: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-22 10:25:23 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:36007: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-22 10:25:38 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:46904: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-22 10:26:17 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:53335: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-22 10:26:39 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:33646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-22 10:27:54 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:4752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-22 10:28:08 dovecot_login authenticator failed for H=([182.78.241.30]) [182.78.241.30]:34948: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.178.172.20
country_id: 6252001
description:
Dec 22 10:28:45 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 85 secs): user=<>, rip=184.178.172.20, lip=66.85.158.91, session=<IDchSINGTr64sqwU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-22 10:28:58 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:42076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-22 10:29:13 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:44492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.91
country_id: 798544
description:
Dec 22 10:31:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=91.246.210.91, lip=66.85.158.91, TLS, session=<qZupUoNGeexb9tJb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.62.177.104
country_id: 3469034
description:
Dec 22 10:31:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=187.62.177.104, lip=66.85.158.91, TLS, session=<e3ywUoNG/K27PrFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Dec 22 10:32:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<sJK4U4NGlaaAf15N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.154.21
country_id: 99237
description:
Dec 22 10:32:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=65.20.154.21, lip=66.85.158.91, TLS, session=<RcLJU4NG0dpBFJoV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 22 10:35:15 host2 pure-ftpd[3381906]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 10:35:24 host2 pure-ftpd[3382035]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.93
country_id: 690791
description:
Dec 22 10:38:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=176.103.25.93, lip=66.85.158.91, TLS, session=<l8wlaYNGYcuwZxld>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.234.3
country_id: 798544
description:
Dec 22 10:37:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=109.125.234.3, lip=66.85.158.91, TLS, session=<ogcFaINGZ+BtfeoD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 22 10:40:17 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<qHxhcYNG8qc26lCA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 22 10:46:02 host2 pure-ftpd[3390721]: (?@164.92.171.132) [INFO] New connection from 164.92.171.132


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.202.199
country_id: 2921044
description:
Dec 22 10:46:01 host2 pure-ftpd[3390687]: (?@164.92.202.199) [INFO] New connection from 164.92.202.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-22 10:55:35 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (renitione) [98.227.25.115]:50948: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-22 10:57:34 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:49078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-22 10:58:15 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.202]:4218: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-22 10:58:41 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:56228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-22 10:58:12 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:35917: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Dec 22 11:05:45 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS: Connection closed, session=<Gcd4zING1BFChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Dec 22 11:05:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CLXJzINGAF5ChJmE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.253.156.155
country_id: 6252001
description:
[2025-12-22 11:10:30 +0530] info [cpaneld] 68.253.156.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.83.120
country_id: 6252001
description:
[2025-12-22 11:10:35 +0530] info [cpaneld] 47.32.83.120 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.144.128
country_id: 6252001
description:
[2025-12-22 11:10:34 +0530] info [cpaneld] 71.38.144.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.10.112
country_id: 6252001
description:
[2025-12-22 11:10:36 +0530] info [whostmgrd] 98.97.10.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.198.87.217
country_id: 6252001
description:
[2025-12-22 11:10:39 +0530] info [cpaneld] 71.198.87.217 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.3.202.64
country_id: 6252001
description:
[2025-12-22 11:10:41 +0530] info [cpaneld] 107.3.202.64 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.12.211.73
country_id: 6252001
description:
[2025-12-22 11:10:42 +0530] info [cpaneld] 108.12.211.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 11:11:10 host2 sshd[3410184]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-22 11:14:02 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:42509: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-22 11:14:22 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:50848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-22 11:19:48 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:43622: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.126
country_id: 2963597
description:
Dec 22 11:20:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=37.203.49.126, lip=66.85.158.91, TLS, session=<xoKr/oNGGMUlyzF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.107.226.235
country_id: 3865483
description:
Dec 22 11:20:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=200.107.226.235, lip=66.85.158.91, TLS, session=<QLiFAIRGOJPIa+Lr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 11:21:19 host2 sshd[3417792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-22 11:23:03 dovecot_login authenticator failed for H=([203.193.147.37]) [203.193.147.37]:50870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-22 11:23:29 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:57648: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-22 11:30:31 dovecot_login authenticator failed for H=([182.95.24.117]) [182.95.56.134]:60460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-22 11:31:02 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:50613: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-22 11:31:21 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:43410: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.29
country_id: 1733045
description:
2025-12-22 11:33:29 dovecot_login authenticator failed for H=([49.124.153.29]) [49.124.153.29]:56276: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-22 11:33:40 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:50728: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 11:35:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (prosen) [87.103.126.54]:43736: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.122.86
country_id: 6252001
description:
Dec 22 11:37:10 host2 sshd[3429454]: Disconnected from invalid user steam 167.99.122.86 port 59404 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 11:37:27 host2 pure-ftpd[3429665]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-12-22 11:37:34 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:59240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-22 11:38:22 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:48960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-22 11:37:58 dovecot_login authenticator failed for H=([128.185.247.254]) [125.19.158.2]:38670: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.122.86
country_id: 6252001
description:
Dec 22 11:38:12 host2 sshd[3430234]: Disconnected from invalid user bitrix 167.99.122.86 port 51552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-22 11:41:38 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:38792: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Dec 22 11:45:11 host2 sshd[3436460]: Disconnected from invalid user app 196.0.120.6 port 46814 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Dec 22 11:46:40 host2 sshd[3438197]: Disconnected from invalid user leonardo 196.0.120.6 port 57970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-22 11:46:21 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:45802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-22 11:46:51 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:41240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 22 11:50:39 host2 dovecot[1601669]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<7dMRbYRG215whtWE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.47.16.142
country_id: 3686110
description:
Dec 22 11:54:33 host2 pure-ftpd[3445205]: (?@154.47.16.142) [INFO] New connection from 154.47.16.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.158
country_id: 146669
description:
Dec 22 11:54:32 host2 pure-ftpd[3445196]: (?@185.253.162.158) [INFO] New connection from 185.253.162.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2025-12-22 11:55:26 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:42965: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-22 11:55:57 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:48312: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-22 11:56:18 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:38350: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Dec 22 11:55:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yGC0f4RGIyDBJf1d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 11:59:13 host2 sshd[3449381]: Disconnected from invalid user admin 2.57.121.112 port 56455 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-22 12:00:18 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:56962: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-22 12:00:00 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:49966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-22 12:01:39 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:50345: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-22 12:02:20 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:53528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.15
country_id: 798549
description:
Dec 22 12:02:56 host2 pure-ftpd[3452666]: (?@85.217.140.15) [INFO] New connection from 85.217.140.15


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.15
country_id: 798549
description:
Dec 22 12:03:08 host2 pure-ftpd[3453033]: (?@85.217.140.15) [INFO] New connection from 85.217.140.15


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 22 12:04:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<C3iYnYRGT4vJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.181
country_id: 3865483
description:
Dec 22 12:05:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=181.118.183.181, lip=66.85.158.91, TLS, session=<1tBan4RG/qm1dre1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-22 12:11:58 dovecot_plain authenticator failed for H=78-66-119-139-no600.tbcn.telia.com (belphal) [78.66.119.139]:54796: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.166.74
country_id: 2921044
description:
Dec 22 12:15:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.166.74, lip=66.85.158.92, TLS, session=<htyLxoRGliikWqZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.242.175.76
country_id: 298795
description:
Dec 22 12:21:30 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=178.242.175.76, lip=66.85.158.91, TLS, session=<zsQ/24RGGKqy8q9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:21:30 host2 sshd[3471284]: Disconnected from invalid user devel 51.91.252.38 port 53916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 22 12:22:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=178.128.203.219, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TkRK3oRG2KCygMvb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:22:34 host2 sshd[3472216]: Disconnected from invalid user deploy 51.91.252.38 port 34576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-22 12:22:55 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-22 12:23:25 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:54874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:24:07 host2 sshd[3473496]: Disconnected from invalid user backup 103.171.85.117 port 58316 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:25:06 host2 sshd[3474434]: Received disconnect from 51.91.252.38 port 44160:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:28:00 host2 sshd[3476735]: Disconnected from invalid user deploy 103.171.85.117 port 40494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:30:55 host2 sshd[3479496]: Disconnected from invalid user admin 103.171.85.117 port 34284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-22 12:30:59 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:39200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-22 12:31:34 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:37124: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 12:39:18 host2 pure-ftpd[3486522]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Dec 22 12:39:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<uuC/GoVGiNeyMLU6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.189
country_id: 3865483
description:
Dec 22 12:39:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.250.189, lip=66.85.158.91, TLS, session=<SSf1G4VGf7yzAPq9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Dec 22 12:48:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS, session=<9LowO4VGruyTuYRJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Dec 22 12:50:39 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<MCOhQ4VGWJAD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.249
country_id: 1733045
description:
2025-12-22 12:54:26 dovecot_login authenticator failed for H=([49.124.152.249]) [49.124.152.249]:49598: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-22 12:54:39 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:59570: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-22 12:54:56 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (chgral) [174.161.27.82]:39567: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 12:56:34 host2 sshd[3502554]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 12:57:23 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61992: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-22 12:57:44 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:60957: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-22 12:59:23 dovecot_login authenticator failed for H=pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:48839: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-22 12:59:54 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:34721: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 12:59:55 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<2fXLZIVG5KADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:00:51 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tYUZaIVGONQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-22 13:01:55 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:50238: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:02:02 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0bRabIVGrsUDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-22 13:01:25 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:46352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-12-22 13:01:47 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:46258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:03:01 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nfXab4VGuq8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:03:51 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4CnacoVGPLgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:04:50 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<z0xbdoVGPLkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:05:37 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<joEteYVGlM0DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:05:46 host2 dovecot[1601669]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<HPqueYVGwsADgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 13:06:46 host2 sshd[3510718]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:06:34 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ztaUfIVGZokDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:06:45 host2 dovecot[1601669]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<AfwxfYVG2pIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:07:46 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BnHTgIVGHrMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:08:44 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<L4hRhIVGRpkDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 13:10:54 host2 sshd[3513668]: Disconnected from invalid user admin 2.57.121.112 port 55650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-22 13:12:22 dovecot_login authenticator failed for H=([46.212.119.125]) [46.212.119.125]:52027: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-22 13:12:50 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:47944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-22 13:12:55 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (oxyging) [76.106.163.189]:59448: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 22 13:14:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<DDJ8moVGcOQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-12-22 13:15:09 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:46872: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-22 13:14:50 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:49055: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-22 13:16:58 dovecot_login authenticator failed for H=([177.236.146.244]) [177.236.146.244]:39913: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-22 13:17:14 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:53284: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 13:19:20 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unfouter) [87.103.126.54]:33928: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-22 13:20:46 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:53436: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-22 13:21:06 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:47752: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Dec 22 13:25:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<C23LwYVGCs6TuYQ/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.211.217
country_id: 1643084
description:
Dec 22 13:27:21 host2 sshd[3527609]: Disconnected from invalid user mailuser 43.157.211.217 port 58812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 22 13:28:59 host2 sshd[3528692]: Disconnected from invalid user user 59.97.205.137 port 43235 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-22 13:30:38 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:41596: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.44.144
country_id: 2921044
description:
Dec 22 13:32:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=8.211.44.144, lip=66.85.158.92, session=<Haqg2YVGUI0I0yyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.228.96
country_id: 1643084
description:
Dec 22 13:35:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=165.154.228.96, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AXxs4oVGpNOlmuRg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-22 13:34:29 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:41450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-12-22 13:34:45 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:58686: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-22 13:35:27 dovecot_plain authenticator failed for H=(crostalaw) [24.105.248.218]:58016: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-22 13:36:03 dovecot_plain authenticator failed for H=amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (untle) [90.0.156.128]:40826: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-22 13:36:05 dovecot_plain authenticator failed for H=c-76-31-164-124.hsd1.tx.comcast.net (trinorpom) [76.31.164.124]:37500: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.228.96
country_id: 1643084
description:
Dec 22 13:39:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.228.96, lip=66.85.158.91, TLS, session=<z6QI8YVG4K6lmuRg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.62.177.90
country_id: 3469034
description:
Dec 22 13:40:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=187.62.177.90, lip=66.85.158.91, TLS, session=<ht7G84VGF467PrFa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.163
country_id: 3865483
description:
Dec 22 13:40:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=179.0.249.163, lip=66.85.158.91, TLS, session=<Sn0Z9YVGI6uzAPmj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 13:41:48 host2 pure-ftpd[3541718]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 22 13:43:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<EKHsAIZGqr1ChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 13:44:20 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<H5B7A4ZG5OrBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.10
country_id: 3175395
description:
Dec 22 13:44:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.10, lip=66.85.158.91, TLS, session=<VuqBBIZGCoC5D6sK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Dec 22 13:45:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<8h2mBYZG+pazAPqa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 13:46:42 host2 sshd[3547424]: Disconnected from invalid user admin 2.57.121.112 port 65506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-22 13:47:59 dovecot_plain authenticator failed for H=(larassed) [64.72.74.162]:58784: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 22 13:52:19 host2 pure-ftpd[3553767]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.152.250.192
country_id: 3469034
description:
Dec 22 13:54:15 host2 sshd[3556461]: Disconnected from invalid user wireguard 164.152.250.192 port 60448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:57:14 host2 sshd[3560527]: Disconnected from invalid user guest 185.196.8.253 port 45384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:57:45 host2 sshd[3560965]: Disconnected from invalid user emo 185.196.8.253 port 44546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec 22 13:57:28 host2 sshd[3560745]: Disconnected from invalid user vpn 43.160.200.211 port 59766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 22 13:59:29 host2 sshd[3562628]: Disconnected from invalid user emo 66.154.125.60 port 43642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.152.250.192
country_id: 3469034
description:
Dec 22 14:00:11 host2 sshd[3563459]: Disconnected from invalid user yaraque 164.152.250.192 port 49616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:59:21 host2 sshd[3562493]: Disconnected from invalid user kevin 185.196.8.253 port 46496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 22 14:00:49 host2 sshd[3564088]: Disconnected from invalid user wj 202.157.177.161 port 58948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec 22 14:03:18 host2 sshd[3566580]: Disconnected from invalid user test 43.160.200.211 port 60028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 22 14:02:41 host2 sshd[3565873]: Disconnected from invalid user guest 202.157.177.161 port 37876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Dec 22 14:03:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.95, lip=66.85.158.91, TLS, session=<vql6RoZGju3G6xhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-22 14:03:04 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:35191: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-22 14:03:51 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:54842: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-22 14:06:22 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:57252: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-22 14:07:21 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:39026: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 22 14:08:50 host2 pure-ftpd[3572761]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-22 14:10:15 dovecot_login authenticator failed for H=([195.222.57.183]) [195.222.57.183]:37144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-22 14:10:27 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:37820: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:20 +0530] info [cpaneld] 197.144.55.53 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.144.55.53
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.144.55.53] [Remote Port]=[11044] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Mon Dec 22 08:58:25 2025 UTC/Mon Dec 22 14:28:25 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:24 +0530] info [cpaneld] 197.144.55.53 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:30 +0530] info [cpaneld] 197.144.55.53 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-22 14:16:33 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:43846: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-22 14:16:50 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:34138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:19:23 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Y6H2gIZGWLsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-12-22 14:21:21 dovecot_login authenticator failed for H=([49.124.155.162]) [49.124.155.162]:51952: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-22 14:21:44 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:36118: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:21:55 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<hsMEioZGcJ4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:22:25 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ATLQi4ZG5t8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.6.176
country_id: 6252001
description:
Dec 22 14:24:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.22.6.176, lip=66.85.158.92, session=<XfKvkoZGwIilFgaw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:24:57 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<WtzklIZGkIsDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Dec 22 14:25:25 host2 sshd[3586237]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 58472


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:25:39 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jh1ll4ZG+JEDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:26:14 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nZJ4mYZGAKIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:26:49 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<156Im4ZGNIUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:32:38 dovecot_login authenticator failed for H=(vhYaAQ) [178.16.54.97]:61828: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:33:25 dovecot_login authenticator failed for H=(pod0z0T9j) [178.16.54.97]:57167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:34:35 dovecot_login authenticator failed for H=(2zxztRJX) [178.16.54.97]:58125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.120.137
country_id: 798544
description:
Dec 22 14:38:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.231.120.137, lip=66.85.158.91, TLS, session=<x3KfxIZGINFb53iJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.227
country_id: 3469034
description:
Dec 22 14:38:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=187.120.73.227, lip=66.85.158.91, TLS, session=<BeizxYZGi+C7eEnj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 14:41:45 host2 sshd[3599408]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 14:44:07 host2 pure-ftpd[3601317]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-22 14:49:38 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:40486: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-22 14:49:52 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:46268: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 14:51:56 host2 sshd[3608380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-22 14:55:29 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:60707: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-22 14:55:54 dovecot_login authenticator failed for H=71-208-122-185.ftmy.qwest.net [71.208.122.185]:56886: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.132
country_id: 6252001
description:
Dec 22 14:57:30 host2 pure-ftpd[3613133]: (?@64.62.156.132) [INFO] New connection from 64.62.156.132


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 14:57:54 host2 sshd[3613389]: Disconnected from invalid user ttt 185.196.11.247 port 60028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 14:59:44 host2 sshd[3614819]: Disconnected from invalid user mqm 103.187.165.26 port 35370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.216
country_id: 6252001
description:
Dec 22 15:01:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.216, lip=66.85.158.92, session=<megwGYdGTPrG6xjY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 15:02:26 host2 sshd[3616677]: Disconnected from invalid user yann 185.196.11.247 port 41884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 15:02:52 host2 sshd[3616928]: Disconnected from invalid user backups 103.187.165.26 port 51588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 15:02:56 host2 sshd[3616972]: Disconnected from invalid user andrew 185.196.11.247 port 60260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:03:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<NnB5IIdG1r8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-22 15:04:16 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:48882: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-22 15:03:46 dovecot_login authenticator failed for H=(201.173.216.16-clientes-izzi.mx) [201.173.216.16]:46153: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-22 15:04:26 dovecot_login authenticator failed for H=([93.121.175.220]) [93.121.175.220]:60224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-22 15:04:49 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50304: 535 Incorrect authentication data


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 15:04:53 host2 sshd[3618518]: Disconnected from invalid user webftp 103.187.165.26 port 53354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-22 15:05:18 dovecot_login authenticator failed for H=([172.82.64.201]) [172.82.64.201]:48908: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.5
country_id: 798544
description:
Dec 22 15:07:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=91.228.33.5, lip=66.85.158.91, TLS, session=<TCtnKodGWu1b5CEF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:06:21 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<yWfxKIdGDugDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:08:17 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<IU7UL4dG5tgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.154.139
country_id: 2782113
description:
Dec 22 15:07:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.255.154.139, lip=66.85.158.91, TLS, session=<6kSiK4dGh9pV/5qL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-22 15:07:52 dovecot_login authenticator failed for H=c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:32682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-22 15:08:11 dovecot_login authenticator failed for H=([46.210.94.61]) [46.210.94.61]:39118: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:09:10 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<mRH6ModG+OcDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-22 15:09:15 dovecot_login authenticator failed for H=([210.56.12.205]) [210.56.12.205]:39292: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:10:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<9pW3N4dGEuYDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:11:08 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<+dgOOodG3tcDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 15:12:26 host2 sshd[3624657]: Disconnected from invalid user user 2.57.121.25 port 46653 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:13:07 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<e7IfQYdG4KoDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:14:02 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<L8BrRIdGWpYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:13:24 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YTIsQodGEpYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-12-22 15:16:09 dovecot_login authenticator failed for H=([125.20.224.10]) [125.20.224.10]:41554: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:15:56 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<uUgxS4dGEKMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.72
country_id: 1733045
description:
2025-12-22 15:17:12 dovecot_login authenticator failed for H=([49.124.151.72]) [49.124.151.72]:55650: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-22 15:21:45 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:47540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 15:22:09 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:38183: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.124.206.113
country_id: 630336
description:
2025-12-22 15:24:01 dovecot_login authenticator failed for H=mm-113-206-124-178.static.mgts.by ([127.0.0.1]) [178.124.206.113]:33870: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2025-12-22 15:24:15 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.39]:38276: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.115.2.252
country_id: 6252001
description:
2025-12-22 15:25:46 dovecot_login authenticator failed for H=([127.0.0.1]) [172.115.2.252]:60842: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.49.162.33
country_id: 3686110
description:
2025-12-22 15:26:04 dovecot_login authenticator failed for H=([127.0.0.1]) [179.49.162.33]:59562: 535 Incorrect authentication data (set_id=chitral100)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-22 15:28:11 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:41190: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-22 15:28:27 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:39870: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-22 15:38:04 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:45276: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-22 15:38:26 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:49088: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 22 15:39:17 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, TLS, session=<IMa1nodGstNV2ZUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 22 15:39:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, TLS: Connection closed, session=<DZazn4dG3LtV2ZUU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:41:54 host2 sshd[3652619]: Disconnected from invalid user vmuser 34.142.110.144 port 34804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:43:01 host2 sshd[3653980]: Disconnected from invalid user test_user 34.142.110.144 port 58816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.192.98.140
country_id: 3469034
description:
Dec 22 15:42:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=200.192.98.140, lip=66.85.158.91, TLS, session=<V7AFqYdGBuzIwGKM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.233
country_id: 690791
description:
Dec 22 15:42:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.7.233, lip=66.85.158.91, TLS, session=<x5Q8qodGKdywZwfp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:44:20 host2 sshd[3655515]: Disconnected from invalid user ubuntu 172.172.130.40 port 49158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:43:29 host2 sshd[3654515]: Disconnected from invalid user user04 177.93.215.39 port 39228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.116.100
country_id: 3469034
description:
Dec 22 15:43:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.87.116.100, lip=66.85.158.91, TLS, session=<16l/rYdGwcKxV3Rk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.193.129.120
country_id: 6290252
description:
Dec 22 15:44:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=62.193.129.120, lip=66.85.158.91, TLS, session=<H5+urodGt9k+wYF4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:44:05 host2 sshd[3655254]: Disconnected from invalid user ceshi 34.142.110.144 port 54596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:45:21 host2 sshd[3657177]: Disconnected from invalid user admin 177.93.215.39 port 34822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:46:07 host2 sshd[3657717]: Disconnected from invalid user user04 177.93.215.39 port 46310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 15:46:15 host2 sshd[3657806]: Disconnected from invalid user user 2.57.121.25 port 23964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-22 15:45:28 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:49498: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-22 15:45:43 dovecot_login authenticator failed for H=([196.190.43.139]) [196.190.41.137]:39438: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 15:46:33 host2 pure-ftpd[3658022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:47:34 host2 sshd[3658750]: Disconnected from invalid user chatbot 177.93.215.39 port 41050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:48:11 host2 sshd[3659130]: Disconnected from invalid user pm2 35.231.227.246 port 33788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 22 15:48:37 host2 sshd[3659419]: Disconnected from invalid user samp 43.133.148.170 port 36110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:49:00 host2 sshd[3659674]: Disconnected from invalid user june 172.172.130.40 port 37780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:49:37 host2 sshd[3660123]: Disconnected from invalid user awx 35.231.227.246 port 55426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-22 15:51:01 dovecot_login authenticator failed for H=([121.73.169.153]) [121.73.169.153]:37370: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:51:03 host2 sshd[3661472]: Disconnected from invalid user minecraft 35.231.227.246 port 35782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 15:51:14 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:60586: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 22 15:50:29 host2 sshd[3661052]: Disconnected from invalid user user1 43.133.148.170 port 50440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.115.56.44
country_id: 3686110
description:
Dec 22 15:51:25 host2 sshd[3661710]: Disconnected from invalid user debian 186.115.56.44 port 49744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:52:00 host2 sshd[3662048]: Disconnected from invalid user samp 172.172.130.40 port 34484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.115.56.44
country_id: 3686110
description:
Dec 22 15:52:45 host2 sshd[3662533]: Disconnected from invalid user june 186.115.56.44 port 49228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-22 15:55:11 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:44789: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-22 15:55:31 dovecot_login authenticator failed for H=([187.252.170.147]) [187.252.170.147]:42286: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 15:55:49 dovecot_login authenticator failed for H=(189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:55468: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:01:12 host2 sshd[3669622]: Disconnected from invalid user tempuser 107.150.110.167 port 40864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:02:22 host2 sshd[3670260]: Disconnected from invalid user ociistst 107.150.110.167 port 10656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 22 16:03:42 host2 sshd[3671130]: Disconnected from invalid user intell 167.99.49.89 port 39588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.236.85.34
country_id: 3469034
description:
Dec 22 16:03:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=45.236.85.34, lip=66.85.158.91, TLS, session=<DUNo9YdGS5At7FUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.111
country_id: 3175395
description:
Dec 22 16:03:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.197.8.111, lip=66.85.158.91, TLS, session=<iPxD9IdG9dW5xQhv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:04:43 host2 sshd[3671674]: Disconnected from invalid user ftpadmin 36.78.222.219 port 46968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 22 16:05:43 host2 sshd[3672475]: Disconnected from invalid user pms 89.107.10.66 port 41236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:05:47 host2 sshd[3672524]: Disconnected from invalid user ubuntu 107.150.110.167 port 30036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:07:10 host2 sshd[3673197]: Disconnected from invalid user eas 36.78.222.219 port 49282 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:07:22 host2 sshd[3673318]: Received disconnect from 107.150.110.167 port 12218:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:07:55 host2 sshd[3673643]: Disconnected from invalid user pro 36.78.222.219 port 32974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 22 16:08:33 host2 sshd[3674527]: Disconnected from invalid user jens 89.107.10.66 port 50554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:08:46 host2 sshd[3674677]: Disconnected from invalid user webftp 36.78.222.219 port 41830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 22 16:09:39 host2 sshd[3675284]: Disconnected from invalid user db2inst1 103.100.211.35 port 57052 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.71.161.171
country_id: 6252001
description:
Dec 22 16:11:06 host2 pure-ftpd[3676675]: (?@167.71.161.171) [INFO] New connection from 167.71.161.171


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:16:51 host2 sshd[3682421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:18:22 host2 sshd[3683433]: Disconnected from invalid user admin 108.173.137.12 port 51096 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:20:07 host2 sshd[3684863]: Disconnected from invalid user postgres 108.173.137.12 port 41124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:20:42 host2 sshd[3685368]: Disconnected from invalid user alice 108.173.137.12 port 56816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 22 16:20:48 host2 sshd[3685414]: Disconnected from invalid user ubnt 101.36.108.134 port 46132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 22 16:21:22 host2 sshd[3685816]: Disconnected from invalid user bot2 101.36.108.134 port 43634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 22 16:22:59 host2 sshd[3686872]: Disconnected from invalid user webapps 103.172.205.208 port 49978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-22 16:25:14 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:54718: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-22 16:25:36 dovecot_login authenticator failed for H=([37.142.173.63]) [37.142.173.63]:55896: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:26:48 host2 sshd[3689702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 22 16:28:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<fkfDTohGVNUs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 16:29:59 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61427: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 22 16:30:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS handshaking: Connection closed, session=<h31xVYhG/EdChJmI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 22 16:32:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VI7oW4hGkodChJlw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:32:50 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<rxo6XohGgpDPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:32:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<M009XohGipDPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-22 16:33:57 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-22 16:34:26 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:44368: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-12-22 16:35:09 dovecot_login authenticator failed for H=([182.95.46.178]) [182.95.46.178]:52296: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:37:01 host2 sshd[3697756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.9
country_id: 6252001
description:
Dec 22 16:37:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.9, lip=66.85.158.91, session=<ocnPbYhGmOkUqWkJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-22 16:38:13 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:35676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-22 16:37:24 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:50354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-22 16:37:39 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:38514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-22 16:38:34 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:60288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-22 16:41:16 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:61126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-12-22 16:41:32 dovecot_login authenticator failed for H=(49.207.9.39.actcorp.in) [49.207.9.39]:59822: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 16:43:05 host2 sshd[3702282]: Disconnected from invalid user admin 2.57.121.112 port 17667 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.226
country_id: 6252001
description:
Dec 22 16:43:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.174.226, lip=66.85.158.92, session=<XZl3hYhGXKIofK7i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.206
country_id: 6252001
description:
Dec 22 16:45:22 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qlcKi4hGCz9APpzO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Dec 22 16:45:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hHMGjIhGQp7Y2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Dec 22 16:45:40 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ryAjjIhGrCVAPpzK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 16:48:59 host2 pure-ftpd[3707180]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:51:43 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<XQO+oYhGptTPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:51:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<oyjFoYhGstTPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-22 17:08:22 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:44768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-22 17:08:53 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:50022: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-22 17:09:23 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:53749: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-22 17:10:12 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:36392: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-22 17:10:12 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:37285: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.81
country_id: 3996063
description:
2025-12-22 17:10:31 dovecot_login authenticator failed for H=([177.236.144.81]) [177.236.144.81]:38360: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-22 17:10:28 dovecot_login authenticator failed for H=([182.160.107.51]) [182.160.107.51]:43622: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-22 17:12:11 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:49086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-22 17:12:26 dovecot_login authenticator failed for H=([125.19.154.158]) [125.19.154.158]:56350: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:12:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9EEp7YhG5pEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:14:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AapW84hGVsIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:16:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<XYvk+IhG5rMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 17:16:19 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:58963: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-22 17:15:23 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:50414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-12-22 17:15:40 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:47131: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:16:54 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<cQbV+4hGIuADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.106
country_id: 3469034
description:
Dec 22 17:17:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.44.96.106, lip=66.85.158.91, TLS, session=<5ZR++4hGZN+xLGBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 22 17:16:40 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<VUn9+ohGUMk2xDDo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.30
country_id: 1269750
description:
Dec 22 17:16:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.164.246.30, lip=66.85.158.91, TLS, session=<H1JI+ohGSe1npPYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 17:17:53 host2 sshd[3730456]: Disconnected from invalid user admin 2.57.121.112 port 29641 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:18:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<7ds4AYlGstsDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:19:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pThmBYlGduIDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2025-12-22 17:19:49 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us ([127.0.0.1]) [51.81.211.221]:41028: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.28
country_id: 3996063
description:
2025-12-22 17:20:13 dovecot_login authenticator failed for H=([127.0.0.1]) [201.173.216.28]:47259: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 22 17:20:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<KP1kCIlGgOo26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:21:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7mXEColGouEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:22:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<bOYLD4lG2ucDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.203
country_id: 1269750
description:
Dec 22 17:21:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.164.246.203, lip=66.85.158.91, TLS, session=<e717C4lG4u1npPbL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.234
country_id: 732800
description:
Dec 22 17:21:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.255.212.234, lip=66.85.158.91, TLS, session=<xWmpDIlGVai5/9Tq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 17:51:40 host2 pure-ftpd[3760432]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 17:52:47 host2 sshd[3760991]: Disconnected from invalid user admin 2.57.121.112 port 9364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-22 17:55:55 dovecot_login authenticator failed for H=(abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:48539: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-22 17:56:14 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:36651: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 18:00:51 host2 sshd[3768254]: Disconnected from invalid user user 2.57.121.25 port 30385 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-22 18:02:10 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:52328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-22 18:02:30 dovecot_login authenticator failed for H=([177.236.146.168]) [177.236.146.168]:60340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 18:03:53 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:51546: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-22 18:05:46 dovecot_login authenticator failed for H=(nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:54738: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-22 18:06:11 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65517: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 18:08:09 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:58844: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 18:11:39 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:56984: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-12-22 18:11:41 dovecot_login authenticator failed for H=c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:48802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-12-22 18:12:08 dovecot_login authenticator failed for H=([95.35.29.192]) [95.35.29.192]:45167: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-22 18:13:17 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:58386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-22 18:13:35 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:55525: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 18:14:14 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:48054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:15:04 host2 sshd[3780708]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-22 18:14:42 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:59854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:14:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:51824: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:17:15 host2 sshd[3782853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 18:18:28 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:38522: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:20:54 host2 sshd[3786677]: Disconnected from invalid user oracle 107.155.55.174 port 39106 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:21:54 host2 sshd[3787639]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-22 18:21:25 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au ([127.0.0.1]) [194.223.20.191]:37881: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.109.101
country_id: 3144096
description:
2025-12-22 18:21:32 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.109.101]:38713: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:21:29 host2 sshd[3787245]: Disconnected from invalid user ubuntu 20.123.120.169 port 38204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:21:34 host2 sshd[3787319]: Disconnected from invalid user splunk 107.155.55.174 port 52672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:21:35 host2 sshd[3787343]: Disconnected from invalid user cyber 189.47.10.63 port 40000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 18:21:59 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:60514: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:22:54 host2 sshd[3788604]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 18:22:56 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:46354: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:23:37 host2 sshd[3789393]: Disconnected from invalid user ubuntu 107.155.55.174 port 36906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:23:43 host2 sshd[3789534]: Disconnected from invalid user wx 189.47.10.63 port 44834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:23:46 host2 sshd[3789574]: Disconnected from invalid user app 20.123.120.169 port 47570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:24:41 host2 sshd[3790560]: Disconnected from invalid user rr 189.47.10.63 port 56218 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:25:34 host2 sshd[3791773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:25:31 host2 sshd[3791729]: Disconnected from invalid user oracle 20.123.120.169 port 54098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 18:25:59 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:45542: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:27:16 host2 sshd[3793463]: Disconnected from invalid user user 20.123.120.169 port 58086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-22 18:27:23 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:36258: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 18:27:29 host2 sshd[3793655]: Disconnected from invalid user admin 2.57.121.112 port 32215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-22 18:28:02 dovecot_login authenticator failed for H=(static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:49825: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 18:30:20 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:34852: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.49
country_id: 798544
description:
Dec 22 18:34:11 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.33.49, lip=66.85.158.91, TLS, session=<HKQ+D4pGXghb5CEx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 18:34:13 host2 sshd[3800354]: Disconnected from invalid user user 2.57.121.25 port 10581 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.187.48.82
country_id: 130758
description:
Dec 22 18:34:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=185.187.48.82, lip=66.85.158.91, TLS, session=<ePxTEIpGfqm5uzBS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 18:38:09 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:31440: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.96
country_id: 3175395
description:
Dec 22 18:39:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info>, method=PLAIN, rip=185.15.171.96, lip=66.85.158.91, TLS, session=<jE2mIYpGkNe5D6tg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 18:38:32 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:1233: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.89
country_id: 798544
description:
Dec 22 18:38:49 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=178.216.29.89, lip=66.85.158.91, TLS, session=</evGH4pGrISy2B1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 18:39:01 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:42656: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.234
country_id: 2963597
description:
Dec 22 18:39:02 host2 dovecot[1601669]: imap-login: Disconnected: Shutting down (auth failed, 3 attempts in 11 secs): user=<info>, method=PLAIN, rip=89.106.141.234, lip=66.85.158.91, session=<DMHfIIpG9OFZao3q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:40:28 host2 sshd[3806283]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 18:43:23 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:52216: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:45:14 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:52810: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:45:22 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:41406: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:48:15 host2 sshd[3813677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 18:48:48 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:36506: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 18:49:15 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:49704: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 18:50:03 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:36500: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 18:50:49 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:36968: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-22 18:53:13 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:48138: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:53:33 host2 sshd[3818021]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.244.206.6
country_id: 1643084
description:
2025-12-22 18:53:38 dovecot_plain authenticator failed for H=(localhost) [103.244.206.6]:44666: 535 Incorrect authentication data (set_id=sales@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-22 18:53:56 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:54250: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-22 18:54:11 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:44542: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-12-22 18:54:31 dovecot_login authenticator failed for H=107.93.206.77.rev.sfr.net [77.206.93.107]:45716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 18:54:32 host2 pure-ftpd[3819149]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 18:54:36 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:40786: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-22 18:54:49 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:42421: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-12-22 18:56:17 dovecot_login authenticator failed for H=([203.124.44.231]) [203.124.44.231]:42264: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 18:56:40 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:53980: 535 Incorrect authentication data (set_id=sales@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 18:59:25 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:39990: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:01:10 host2 sshd[3824303]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:00:38 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44692: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:01:08 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:59556: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:01:16 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:39252: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 19:01:20 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:45126: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 19:01:41 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:57396: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 19:04:05 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:52966: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 217.125.83.165
country_id: 2510769
description:
Dec 22 19:05:05 host2 sshd[3827336]: Disconnected from invalid user ftpuser 217.125.83.165 port 40401 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.125.83.165
country_id: 2510769
description:
Dec 22 19:06:21 host2 sshd[3828483]: Disconnected from invalid user admin 217.125.83.165 port 64595 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 19:09:33 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:39990: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:10:44 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:55718: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 22 19:11:00 host2 sshd[3833093]: Disconnected from invalid user developer 152.32.203.205 port 59982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 22 19:12:09 host2 sshd[3834106]: Disconnected from invalid user postgres 154.91.81.224 port 36862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 22 19:13:23 host2 sshd[3835437]: Disconnected from invalid user user1 152.32.203.205 port 38200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:14:41 host2 sshd[3836494]: Disconnected from invalid user sysuser 152.32.130.118 port 42842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 19:15:04 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:54626: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 22 19:15:04 host2 sshd[3836964]: Disconnected from invalid user deployroot 154.91.81.224 port 33794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 19:14:17 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:57778: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 19:16:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<L+adp4pGlMLBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:16:47 host2 sshd[3838613]: Disconnected from invalid user element 138.99.80.102 port 37480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:17:29 host2 sshd[3839165]: Disconnected from invalid user user1 138.99.80.102 port 42528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 19:17:43 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:53820: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:18:43 host2 sshd[3840153]: Disconnected from invalid user apache 138.99.80.102 port 55236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.94
country_id: 3175395
description:
Dec 22 19:18:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.94, lip=66.85.158.91, TLS, session=<64Yyr4pGl9u5D6le>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.222
country_id: 3175395
description:
Dec 22 19:19:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=185.15.169.222, lip=66.85.158.91, TLS, session=<376FsIpGeLy5D6ne>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:19:43 host2 sshd[3840945]: Disconnected from invalid user gitlab 152.32.130.118 port 59374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:20:22 host2 sshd[3841643]: Disconnected from invalid user git 152.32.130.118 port 36938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 19:21:05 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:59948: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:21:49 host2 sshd[3842744]: Disconnected from invalid user account 185.141.132.26 port 49994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 19:23:30 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:54982: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:23:34 host2 sshd[3843894]: Disconnected from invalid user admin 185.141.132.26 port 47698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:23:46 host2 sshd[3843971]: Disconnected from invalid user admin 206.189.130.118 port 57684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:24:07 host2 sshd[3844206]: Disconnected from invalid user user 185.141.132.26 port 45666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:24:24 host2 sshd[3844376]: Disconnected from invalid user account 206.189.130.118 port 45884 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 22 19:24:29 host2 pure-ftpd[3844449]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:24:43 host2 sshd[3844558]: Disconnected from invalid user ubuntu 185.141.132.26 port 52920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:26:21 host2 sshd[3846147]: Disconnected from invalid user frappe-user 185.141.132.26 port 44516 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:27:32 host2 sshd[3846927]: Disconnected from invalid user xue 206.189.130.118 port 47468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 19:27:42 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:48758: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-22 19:29:02 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:50650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Dec 22 19:29:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.22, lip=66.85.158.91, TLS: Connection closed, session=<oLje1opGZsJV2ZUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-22 19:29:41 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:33002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 22 19:31:11 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<jMEQ3IpG8s5HBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 22 19:31:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GBlX3IpGlNVHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 19:31:46 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:60932: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2025-12-22 19:31:57 dovecot_login authenticator failed for H=([127.0.0.1]) [61.0.228.11]:39184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2025-12-22 19:32:05 dovecot_login authenticator failed for H=([127.0.0.1]) [159.16.201.242]:36155: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 19:32:14 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:52690: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 19:32:20 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:55716: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 19:35:04 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:39092: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:37:09 host2 sshd[3854537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 19:39:35 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:57624: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-22 19:43:39 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:37607: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-22 19:43:51 dovecot_login authenticator failed for H=200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:40300: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-22 19:45:31 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:34511: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 19:45:45 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:46346: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-22 19:45:50 dovecot_login authenticator failed for H=host-24-222-149-239.public.eastlink.ca [24.222.149.239]:60785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-12-22 19:47:11 dovecot_login authenticator failed for H=(74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:40653: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 19:47:14 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:37016: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:47:27 host2 sshd[3864956]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 19:47:40 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:10130: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 19:47:20 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:17510: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-22 19:47:41 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:34308: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 19:48:28 host2 sshd[3865771]: Disconnected from invalid user  62.60.131.157 port 56084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 19:53:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:58056: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 19:56:30 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60876: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.241.224
country_id: 798544
description:
Dec 22 19:57:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.125.241.224, lip=66.85.158.91, TLS, session=<oP1bOItGg5htffHg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 19:57:27 host2 pure-ftpd[3873791]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.107
country_id: 3469034
description:
Dec 22 19:57:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.137.107, lip=66.85.158.91, TLS, session=<LnV6OYtGCaO+WYlr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 19:57:46 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:34056: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:59:12 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:43476: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 19:59:10 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:59339: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:59:18 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:50424: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 19:59:49 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:51276: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 20:04:20 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:41070: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 22 20:05:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dB36VItGurBChJl2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 20:05:31 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:57744: 535 Incorrect authentication data (set_id=sales@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 20:09:40 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:55904: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 20:10:02 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:47852: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 20:10:42 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:34980: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-22 20:13:12 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:58478: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 20:12:16 host2 sshd[3884788]: Disconnected from invalid user  62.60.131.157 port 41848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:12:20 host2 sshd[3884836]: Disconnected from invalid user eas 39.109.104.252 port 55942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:14:00 host2 sshd[3885788]: Disconnected from invalid user transfer 39.109.104.252 port 52714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:14:46 host2 sshd[3886242]: Disconnected from invalid user elasticsearch 39.109.104.252 port 36892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:15:38 host2 sshd[3886900]: Disconnected from invalid user ansible 39.109.104.252 port 49544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 20:17:30 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:56712: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:22:36 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:37268: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-22 20:23:12 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:63160: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-22 20:23:52 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:43628: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 20:27:00 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:49870: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 20:26:35 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:7398: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 20:28:05 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:51082: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 20:28:41 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:56712: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-22 20:28:47 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:60798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-22 20:29:03 dovecot_login authenticator failed for H=(187.161.136.38-clientes-izzi.mx) [187.161.136.38]:59305: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 20:29:26 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:34996: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:34:08 host2 sshd[3900474]: Disconnected from invalid user deploy 20.127.224.153 port 52844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:34:36 host2 sshd[3900764]: Disconnected from invalid user reports 91.147.92.31 port 51170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 20:36:32 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:52922: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:37:12 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:42598: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:37:20 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:60448: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 20:37:58 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:46768: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:38:19 host2 sshd[3903557]: Disconnected from invalid user reports 20.127.224.153 port 39482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-22 20:38:36 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:44026: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 20:38:38 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:41628: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:38:52 host2 sshd[3903877]: Disconnected from invalid user dev 20.127.224.153 port 34952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.254
country_id: 2186224
description:
2025-12-22 20:39:05 dovecot_login authenticator failed for H=([121.73.163.254]) [121.73.163.254]:44972: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-12-22 20:39:22 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:35074: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-22 20:39:49 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:33137: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:40:09 host2 sshd[3904783]: Disconnected from invalid user jy 91.147.92.31 port 54850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:40:34 host2 sshd[3905110]: Disconnected from invalid user willem 20.127.224.153 port 39582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.245.170
country_id: 3469034
description:
2025-12-22 20:42:03 dovecot_login authenticator failed for H=([127.0.0.1]) [187.76.245.170]:37142: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:42:05 host2 sshd[3906311]: Disconnected from invalid user uat 91.147.92.31 port 57332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 22 20:41:51 host2 sshd[3906130]: Disconnected from invalid user ocean 103.164.9.82 port 60658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2025-12-22 20:42:16 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.225.186]:54360: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 22 20:42:34 host2 sshd[3906602]: Disconnected from invalid user soporte 103.164.9.82 port 56844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:42:46 host2 sshd[3906723]: Disconnected from invalid user debian 91.147.92.31 port 58126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:42:58 host2 sshd[3906879]: Disconnected from invalid user indico 12.156.67.18 port 60032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 20:43:09 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:56246: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 20:43:16 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:8642: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:43:31 host2 sshd[3907277]: Disconnected from invalid user den 12.156.67.18 port 40854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:44:39 host2 sshd[3908039]: Disconnected from invalid user roberto 12.156.67.18 port 37624 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.131.177.75
country_id: 6252001
description:
Dec 22 20:45:45 host2 pure-ftpd[3909053]: (?@104.131.177.75) [INFO] New connection from 104.131.177.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.76.155.134
country_id: 1819730
description:
2025-12-22 20:45:56 dovecot_plain authenticator failed for H=(localhost) [47.76.155.134]:48914: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:46:13 host2 sshd[3909739]: Disconnected from invalid user temp 12.156.67.18 port 60218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:47:30 host2 sshd[3910747]: Disconnected from invalid user tp 157.230.211.219 port 42592 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:47:47 host2 sshd[3911010]: Received disconnect from 12.156.67.18 port 49948:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:48:11 host2 sshd[3911298]: Disconnected from invalid user user 157.230.211.219 port 52330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.165
country_id: 99237
description:
Dec 22 20:49:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=65.20.205.165, lip=66.85.158.91, TLS, session=<eajY8YtG49pBFM2l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:48:20 host2 sshd[3911422]: Disconnected from invalid user ocean 12.156.67.18 port 51386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.111.103
country_id: 798544
description:
Dec 22 20:49:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=91.196.111.103, lip=66.85.158.91, TLS, session=<eMDy8otGx7tbxG9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 20:50:27 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33012: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:53:28 host2 sshd[3915445]: Disconnected from invalid user development 104.223.85.124 port 35058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.181.6
country_id: 3865483
description:
Dec 22 20:53:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=190.110.181.6, lip=66.85.158.91, TLS, session=<of4qAoxGE6q+brUG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.36
country_id: 99237
description:
Dec 22 20:54:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=65.20.129.36, lip=66.85.158.91, TLS, session=<EEFlA4xGbItBFIEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-22 20:55:15 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:59392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 20:56:08 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:50322: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:55:39 host2 sshd[3917961]: Disconnected from invalid user ocean 157.230.211.219 port 41542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:56:29 host2 sshd[3918663]: Disconnected from invalid user user 104.223.85.124 port 52672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 20:56:48 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:51466: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:57:05 host2 sshd[3919127]: Disconnected from invalid user ftpUser 104.223.85.124 port 58820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:57:38 host2 sshd[3919489]: Disconnected from invalid user mark 104.223.85.124 port 37442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:57:18 host2 sshd[3919284]: Disconnected from invalid user den 157.230.211.219 port 39982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 20:58:43 host2 sshd[3920264]: Disconnected from invalid user dockeruser 152.32.191.75 port 37134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 22 20:59:36 host2 sshd[3920834]: Disconnected from invalid user ftp_user 103.153.190.105 port 43066 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 21:00:24 host2 pure-ftpd[3921664]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 21:01:50 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:35088: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:02:26 host2 sshd[3923142]: Disconnected from invalid user web 152.32.191.75 port 38288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:03:42 host2 sshd[3924324]: Disconnected from invalid user ftpuser 152.32.191.75 port 39926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 21:04:08 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:47404: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:04:20 host2 sshd[3924828]: Disconnected from invalid user postgres 152.32.191.75 port 44510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-22 21:04:31 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:35570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-22 21:04:58 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:39537: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 21:06:41 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:58690: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 22 21:07:37 host2 sshd[3927345]: Disconnected from invalid user guest 103.153.190.105 port 41903 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 22 21:09:57 host2 pure-ftpd[3928940]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 21:12:13 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:48290: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-22 21:14:00 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:45289: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.232
country_id: 6252001
description:
Dec 22 21:14:42 host2 pure-ftpd[3933407]: (?@198.235.24.232) [INFO] New connection from 198.235.24.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 21:14:51 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:43652: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.142.119
country_id: 690791
description:
Dec 22 21:20:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=37.221.142.119, lip=66.85.158.91, TLS, session=<wPcuYIxGXocl3Y53>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 159.255.144.35
country_id: 3175395
description:
Dec 22 21:20:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=159.255.144.35, lip=66.85.158.91, TLS, session=<ejAxYoxGCbaf/5Aj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 21:23:19 host2 sshd[3942721]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.121
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.121: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:24:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SK2ocYxGItyi2JW3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:25:23 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<xs51dIxGlPui2JW3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 21:26:16 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:42146: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 21:26:22 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:42654: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-22 21:27:09 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:39086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-22 21:28:00 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:39734: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-22 21:30:00 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:33966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 21:30:19 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:49320: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 21:30:27 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:39290: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 21:31:23 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:54828: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.47.74
country_id: 2750405
description:
Dec 22 21:31:55 host2 pure-ftpd[3951616]: (?@167.172.47.74) [INFO] New connection from 167.172.47.74


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:32:30 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS, session=<uFLijYxGpO2i2JW3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 21:32:41 host2 sshd[3952274]: Disconnected from invalid user  62.60.131.157 port 20327 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 21:33:36 host2 sshd[3953565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 21:37:14 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:39040: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 21:37:24 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:38154: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 21:37:39 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:2627: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 21:38:42 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:1302: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 21:39:52 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:49780: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec 22 21:39:54 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, session=<LWFnqIxGLi+nXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-22 21:42:28 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:52740: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.205.71
country_id: 1605651
description:
2025-12-22 21:43:21 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.175.205.71]:59403: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-22 21:45:59 dovecot_login authenticator failed for H=210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:39141: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-22 21:46:11 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:47171: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:49:21 host2 sshd[3991365]: Disconnected from invalid user ftpuser1 152.42.231.101 port 52018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:49:35 host2 sshd[3991533]: Disconnected from invalid user admin 49.228.105.174 port 40026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:54:18 host2 sshd[3996111]: Disconnected from invalid user esuser 152.42.231.101 port 59584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:53:31 host2 sshd[3994769]: Disconnected from invalid user sap_user 152.42.231.101 port 57668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:55:03 host2 sshd[3996719]: Disconnected from invalid user ftpuser 152.42.231.101 port 57158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:56:04 host2 sshd[3997792]: Disconnected from invalid user ubuntu 49.228.105.174 port 56658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-22 21:56:05 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:10244: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-22 21:56:30 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:36112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 21:57:23 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:53286: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-22 21:57:24 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:41686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 21:57:40 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:55382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.14.65
country_id: 2464461
description:
[2025-12-22 21:58:54 +0530] info [cpaneld] 196.178.14.65 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.178.14.65
country_id: 2464461
description:
Dec 22 21:58:53 host2 sshd[3999917]: Invalid user cloudtourssrilan_travel from 196.178.14.65 port 54823


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:59:10 host2 sshd[4000168]: Disconnected from invalid user TestUser 49.228.105.174 port 51374 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-22 21:59:24 +0530] info [cpaneld] 159.223.46.235 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec 22 22:03:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<Nbox+4xGko9ChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:03:12 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:45460: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 22:03:22 host2 pure-ftpd[4003609]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.66
country_id: 3996063
description:
Dec 22 22:04:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=138.122.97.66, lip=66.85.158.91, TLS, session=<sDZg/YxGWIOKemFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.194.113
country_id: 3865483
description:
Dec 22 22:04:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan>, method=PLAIN, rip=186.96.194.113, lip=66.85.158.91, TLS, session=<VPW5/oxG4eq6YMJx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 22:07:17 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:57300: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-22 22:10:04 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:37330: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-22 22:10:33 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:47964: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:10:54 host2 sshd[4010007]: Disconnected from invalid user ron 58.153.142.234 port 4398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 22:11:14 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:36478: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 22:11:47 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:36020: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.238
country_id: 6252001
description:
Dec 22 22:12:27 host2 pure-ftpd[4011403]: (?@198.235.24.238) [INFO] New connection from 198.235.24.238


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:14:55 host2 sshd[4013924]: Disconnected from invalid user nelson 58.153.142.234 port 57358 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-22 22:14:45 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 22 22:14:48 host2 sshd[4013814]: Disconnected from invalid user celia 83.142.209.191 port 40408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:16:14 host2 sshd[4015122]: Disconnected from invalid user richard 58.153.142.234 port 35146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.163
country_id: 3017382
description:
Dec 22 22:16:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.163, lip=66.85.158.91, session=<FGTBK41Gi61bxJij>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Dec 22 22:16:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.145, lip=66.85.158.91, session=<+VVyLI1G/dRbxJiR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.146
country_id: 3017382
description:
Dec 22 22:17:01 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.146, lip=66.85.158.91, session=<RDsdLY1Ge+VbxJiS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.151
country_id: 3017382
description:
Dec 22 22:17:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.151, lip=66.85.158.91, session=<Xb9PLY1GQYZbxJiX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 22:19:28 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33710: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-22 22:24:43 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:50580: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-22 22:25:10 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:58575: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 22:25:25 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:41448: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.159.244.132
country_id: 6252001
description:
Dec 22 22:25:56 host2 pure-ftpd[4024301]: (?@54.159.244.132) [INFO] New connection from 54.159.244.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 22:27:11 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:42708: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 22:26:57 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:58598: 535 Incorrect authentication data (set_id=help@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:27:54 host2 sshd[4025804]: Disconnected from invalid user boss 103.55.36.22 port 38432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-22 22:32:17 dovecot_login authenticator failed for H=([120.157.13.61]) [120.157.13.61]:33352: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.205.235.254
country_id: 2802361
description:
Dec 22 22:31:41 host2 pure-ftpd[4029649]: (?@35.205.235.254) [INFO] New connection from 35.205.235.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-22 22:32:37 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56330: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:16 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:53166: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:25 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:39484: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:35:25 host2 sshd[4032935]: Disconnected from invalid user webuser 103.55.36.22 port 48836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:37:38 host2 sshd[4034737]: Disconnected from invalid user reza 103.55.36.22 port 38168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 22:37:55 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:42146: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-22 22:37:23 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:42768: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-22 22:37:36 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:42476: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.230
country_id: 6252001
description:
Dec 22 22:38:50 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.230, lip=66.85.158.92, session=<6pYme41G7btBMQHm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:38:58 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:52856: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 22 22:39:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, TLS: Connection closed, session=<9sPZe41GCA5BMQHe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:38:23 host2 sshd[4035377]: Disconnected from invalid user samuel 103.55.36.22 port 53616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 22 22:45:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.92, session=<HPVWk41GzOhV2YwR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 22:45:46 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:35974: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 22:48:54 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36348: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:49:30 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:57932: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 22:49:49 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:48672: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.193.17
country_id: 2750405
description:
Dec 22 22:51:42 host2 pure-ftpd[4047677]: (?@159.65.193.17) [INFO] New connection from 159.65.193.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:51:35 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:44394: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-22 22:53:15 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:35894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-22 22:53:00 dovecot_login authenticator failed for H=([182.95.181.62]) [182.95.181.62]:47010: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.24
country_id: 690791
description:
Dec 22 22:55:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=194.44.140.24, lip=66.85.158.91, TLS, session=</yzntY1GZubCLIwY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.93
country_id: 1269750
description:
Dec 22 22:55:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.8.118.93, lip=66.85.158.91, TLS, session=<0qwDt41G8ulnCHZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 22:57:26 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:51330: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:59:06 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:46636: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2025-12-22 22:59:16 dovecot_login authenticator failed for H=([127.0.0.1]) [45.38.0.41]:4361: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-22 22:59:25 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.230.142]:37630: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-22 23:00:46 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:41188: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-22 23:01:16 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:57608: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:01:27 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:51956: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 23:05:52 host2 pure-ftpd[4060237]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.118
country_id: 3865483
description:
Dec 22 23:07:08 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.238.107.118, lip=66.85.158.91, TLS, session=<OiE/341GOuEt7mt2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 23:06:27 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:8118: 535 Incorrect authentication data (set_id=admin@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.100
country_id: 3175395
description:
Dec 22 23:07:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.100, lip=66.85.158.91, TLS, session=<ITtt4I1G0aW5D6lk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.135.19
country_id: 6252001
description:
[2025-12-22 23:07:32 +0530] info [webmaild] 192.111.135.19 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:09:05 host2 sshd[4062442]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 23:08:37 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:36068: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.226.210
country_id: 6252001
description:
[2025-12-22 23:09:00 +0530] info [webmaild] 142.54.226.210 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:22 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:46690: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:29 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:33544: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.185.192.138
country_id: 1269750
description:
[2025-12-22 23:11:03 +0530] info [webmaild] 128.185.192.138 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:15:35 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:38892: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:15:44 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:34042: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 23:16:46 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:41894: 535 Incorrect authentication data (set_id=hr@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:18:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AzxICo5G/tsjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-22 23:19:06 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:38624: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:19:16 host2 sshd[4069611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-22 23:19:40 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:56406: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:19:46 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42624: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:19:49 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<grGyDY5Gzu0jy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-22 23:20:03 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:59488: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-22 23:19:26 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:44453: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-22 23:23:15 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:44080: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-22 23:23:45 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:56155: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 23:23:46 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:46036: 535 Incorrect authentication data (set_id=help@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-22 23:24:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:37992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-22 23:25:01 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:53252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:25:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS, session=<qrNuII5G+ugjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 23:29:05 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:52410: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.188
country_id: 6252001
description:
Dec 22 23:29:29 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.12.240.188, lip=66.85.158.92, session=<kpNEMI5GYpcUDPC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-22 23:31:48 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:34764: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 23:34:26 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:47264: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-22 23:35:52 dovecot_login authenticator failed for H=([182.95.181.6]) [182.95.181.6]:49860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-22 23:36:06 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:60826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-22 23:37:21 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:38102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-22 23:37:40 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:47233: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.219.221.172
country_id: 2661886
description:
2025-12-22 23:39:49 dovecot_login authenticator failed for H=83-219-221-172.cust.bredband2.com ([127.0.0.1]) [83.219.221.172]:57020: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2025-12-22 23:40:20 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.41]:33082: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:41:13 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:32828: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 23:42:42 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:49378: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-22 23:44:18 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:47470: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-22 23:44:35 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:37706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:45:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:40822: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:51:40 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:37198: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 23:53:52 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:4473: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.107
country_id: 6252001
description:
Dec 22 23:55:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.163.15.107, lip=66.85.158.91, session=<HZzujI5G1oAUow9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 22 23:55:51 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<XayLjo5GetiLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-22 23:59:54 dovecot_login authenticator failed for H=([189.44.251.249]) [186.238.247.238]:40173: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:59:28 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:53712: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Dec 23 00:03:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.5.11, lip=66.85.158.92, session=<64Q8q45GKIItTwUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Dec 23 00:05:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7Zluso5G2khAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Dec 23 00:06:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HJ6Zs45GPKRAPsUC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 00:08:21 host2 pure-ftpd[4112785]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-23 00:10:42 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:46796: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.237.78
country_id: 1269750
description:
2025-12-23 00:10:50 dovecot_login authenticator failed for H=([127.0.0.1]) [14.96.237.78]:55873: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 23 00:11:22 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS handshaking: Connection closed, session=<S7gKxo5GEOdChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 23 00:13:18 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<9pXzzI5GpodChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-23 00:16:56 dovecot_login authenticator failed for H=([5.32.22.218]) [5.32.22.218]:41067: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-23 00:17:08 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:39018: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 23 00:18:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wJfm4I5GoC5BMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-23 00:19:03 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:57486: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.18
country_id: 1269750
description:
Dec 23 00:19:08 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.8.118.18, lip=66.85.158.91, TLS, session=<qYnG4I5GmLFnCHYS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-23 00:19:13 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:48823: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 23 00:19:13 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<to0k4o5GmrVBMQFs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.106.155.68
country_id: 798544
description:
Dec 23 00:19:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.106.155.68, lip=66.85.158.91, TLS, session=<hxPs4Y5GNbrBaptE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:20:13 host2 sshd[4119528]: Disconnected from invalid user andrew 185.216.119.134 port 42802 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.131.4
country_id: 6252001
description:
[2025-12-23 00:20:32 +0530] info [webmaild] 192.111.131.4 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:21:24 host2 sshd[4120282]: Disconnected from invalid user shiny 185.216.119.134 port 60112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 23 00:22:41 host2 sshd[4120948]: Disconnected from invalid user kasia 185.216.119.134 port 55780 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.233.96.173
country_id: 2802361
description:
Dec 23 00:23:41 host2 pure-ftpd[4121473]: (?@35.233.96.173) [INFO] New connection from 35.233.96.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.195.8.95
country_id: 3469034
description:
Dec 23 00:23:52 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=186.195.8.95, lip=66.85.158.91, TLS, session=<Z8qs8Y5GTtC6wwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 00:24:00 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:33134: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Dec 23 00:24:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<gihan>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=<6BZy845GfqgpixLe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-23 00:25:06 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:40660: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 00:26:19 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:48984: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 00:29:23 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43228: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.0.62.84
country_id: 1269750
description:
2025-12-23 00:30:23 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [101.0.62.84]:39729: 535 Incorrect authentication data (set_id=dinali.hettiarachchi@ksoft.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.230
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.230: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 23 00:31:45 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, session=<P131Do9GHKxAPsUg>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.230
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.230: 436 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.172
country_id: 6252001
description:
Dec 23 00:31:30 host2 pure-ftpd[4126656]: (?@205.210.31.172) [INFO] New connection from 205.210.31.172


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 23 00:32:11 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, session=<Ei6HEI9Glp5APsUg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 00:33:15 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:57454: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 00:34:14 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60492: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 00:37:46 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:48182: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 00:39:59 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:47654: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 00:40:17 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:37076: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 00:40:22 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:37988: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2025-12-23 00:42:02 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.201.26]:42492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 00:41:37 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:48598: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 00:41:52 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:45164: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.177.159
country_id: 1643084
description:
2025-12-23 00:41:53 dovecot_login authenticator failed for H=([127.0.0.1]) [112.78.177.159]:54592: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 00:43:38 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:60204: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.44
country_id: 6252001
description:
Dec 23 00:44:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KkPfOo9GdcrN0h8s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 00:47:15 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:34888: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 00:49:54 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34648: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 00:50:29 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:56714: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.109
country_id: 6252001
description:
Dec 23 00:52:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Aw5qV49GIcDG6xht>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 00:51:35 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<OzTIVY9GOMLBHmEh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 00:53:45 host2 sshd[4145756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-23 00:53:54 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:35560: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.62.166
country_id: 3469034
description:
Dec 23 00:54:03 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=168.232.62.166, lip=66.85.158.91, TLS, session=<vz6tXY9GnbKo6D6m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-23 00:53:42 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:43468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.28
country_id: 3175395
description:
Dec 23 00:53:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.28, lip=66.85.158.91, TLS, session=<IceNXI9G+c25D6kc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 00:54:53 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:54702: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.155.16.105
country_id: 1819730
description:
2025-12-23 00:55:44 dovecot_plain authenticator failed for H=(localhost) [43.155.16.105]:59774: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.136
country_id: 6252001
description:
Dec 23 00:57:12 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.136, lip=66.85.158.91, session=<E0r6aY9GzeNBMQGI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Dec 23 00:57:26 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.91, TLS: Connection closed, session=<1HHQao9GCkBBMQGE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-23 01:01:30 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:41160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 01:01:35 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:1508: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 01:02:17 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41048: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 01:03:50 host2 sshd[4154754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-23 01:03:41 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:53534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-23 01:04:02 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:35682: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 01:04:28 host2 sshd[4154813]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 01:06:18 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:60512: 535 Incorrect authentication data (set_id=no-reply@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 01:09:54 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:43656: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 01:10:56 host2 pure-ftpd[4161414]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 01:12:02 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34042: 535 Incorrect authentication data (set_id=no-reply@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-23 01:13:19 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 01:16:43 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:57396: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-23 01:16:45 dovecot_login authenticator failed for H=(201.173.216.62-clientes-izzi.mx) [201.173.216.62]:41942: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-23 01:16:59 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:38606: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-23 01:19:24 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:47368: 535 Incorrect authentication data (set_id=no-reply@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 01:21:52 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:54614: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 01:25:07 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:46856: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.91
country_id: 6252001
description:
Dec 23 01:26:15 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<acHj0Y9GCtWTuYRb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.206.124.248
country_id: 1814991
description:
[2025-12-23 01:26:28 +0530] info [cpaneld] 121.206.124.248 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 01:26:39 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:35214: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.137.33
country_id: 6252001
description:
[2025-12-23 01:29:11 +0530] info [webmaild] 192.111.137.33 - info@weeratrading.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-23 01:29:29 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:52351: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-23 01:29:40 dovecot_login authenticator failed for H=(187.161.136.72-clientes-izzi.mx) [187.161.136.72]:60596: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 01:29:57 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:59480: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 01:32:08 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:52580: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 01:32:31 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:24594: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 01:32:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:60908: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 01:33:16 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:33674: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 01:33:22 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:46292: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 01:33:46 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:51204: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 01:35:49 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:43798: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.164.135.22
country_id: 798544
description:
Dec 23 01:38:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=193.164.135.22, lip=66.85.158.91, TLS, session=<4ThQ+49GFZLBpIcW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.252.126
country_id: 3865483
description:
Dec 23 01:39:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=179.0.252.126, lip=66.85.158.91, TLS, session=<IAd//49Gh4GzAPx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.59.132.17
country_id: 798544
description:
Dec 23 01:39:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.59.132.17, lip=66.85.158.91, TLS, session=<2xov/49GeO3BO4QR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.117.58
country_id: 3469034
description:
Dec 23 01:38:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=177.87.117.58, lip=66.85.158.91, TLS, session=<Bbhs/I9GCNuxV3U6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.106.73
country_id: 3469034
description:
Dec 23 01:38:54 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=187.85.106.73, lip=66.85.158.91, TLS, session=<7v8J/o9G3eO7VWpJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.62
country_id: 2300660
description:
Dec 23 01:38:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 43 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=41.139.60.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6YC8/I9GdIQpizw+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 01:39:19 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:42286: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.57
country_id: 732800
description:
Dec 23 01:39:19 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=185.255.215.57, lip=66.85.158.91, TLS, session=<5k+V/49G2Yu5/9c5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-23 01:42:03 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:50106: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 01:42:32 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:37914: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[47.89.246.144] [Authentication Database]=[mail] [Username]=[support@kiriaswanu.com] (10/10 failures) (blocked until [Tue Dec 23 20:12:30 2025 UTC/Wed Dec 24 01:42:30 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 01:44:38 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:45388: 535 Incorrect authentication data (set_id=hr@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 23 01:45:51 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<A3H8F5BGU/8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 01:47:24 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:34588: 535 Incorrect authentication data (set_id=constact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 01:50:00 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:60314: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.207.124.74
country_id: 2921044
description:
2025-12-23 01:51:25 dovecot_plain authenticator failed for H=74.124.207.35.bc.googleusercontent.com ([26.26.26.1]) [35.207.124.74]:40202: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 01:53:03 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:53136: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 01:54:29 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:53162: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 01:58:27 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:34596: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2025-12-23 01:58:32 dovecot_login authenticator failed for H=([49.124.154.173]) [49.124.154.173]:36966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-23 01:58:53 dovecot_login authenticator failed for H=(cm-84.210.192.240.get.no) [84.210.192.240]:58725: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 01:59:50 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:51076: 535 Incorrect authentication data (set_id=test@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 02:00:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:42394: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 02:01:06 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:54382: 535 Incorrect authentication data (set_id=hr@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 02:00:23 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:36660: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 02:01:24 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:35996: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 02:03:35 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:40464: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.170.248.1
country_id: 6252001
description:
[2025-12-23 02:06:37 +0530] info [webmaild] 184.170.248.1 - info@kiriaswanu.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 02:07:10 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:40118: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.121
country_id: 3469034
description:
Dec 23 02:08:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=200.77.179.121, lip=66.85.158.91, TLS, session=<sWcQZpBGZ8bITbN5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 02:07:17 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:19198: 535 Incorrect authentication data (set_id=hr@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.198
country_id: 3469034
description:
Dec 23 02:07:40 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=187.120.77.198, lip=66.85.158.91, TLS, session=<Xv3BZJBG6aK7eE3G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.165.13
country_id: 3865483
description:
Dec 23 02:09:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.181.165.13, lip=66.85.158.91, TLS, session=<tf8vapBGApYttaUN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.101.75
country_id: 3175395
description:
Dec 23 02:09:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.112.101.75, lip=66.85.158.91, TLS, session=<Jn2La5BGL6bZcGVL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 02:10:22 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:39572: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-23 02:12:12 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:60444: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-23 02:12:17 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:54342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 02:13:12 host2 pure-ftpd[18533]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-23 02:12:33 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:33560: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.13.207.39
country_id: 3077311
description:
2025-12-23 02:12:36 dovecot_login authenticator failed for H=46-13-207-39.customers.tmcz.cz [46.13.207.39]:34255: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-23 02:14:25 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:36448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 02:14:43 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:54846: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 02:20:41 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60325: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 02:21:19 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:9427: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 02:21:30 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:60600: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 02:22:35 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:46962: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.206.124.248
country_id: 1814991
description:
[2025-12-23 02:26:23 +0530] info [cpaneld] 121.206.124.248 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 02:29:20 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:54702: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 02:32:20 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:33964: 535 Incorrect authentication data (set_id=test@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-23 02:34:18 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:51039: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 02:34:41 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:58376: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 02:37:46 host2 sshd[40188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 02:37:52 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:47332: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 02:41:07 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:34668: 535 Incorrect authentication data (set_id=admin@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-23 02:42:50 dovecot_login authenticator failed for H=(cm-178.232.111.229.get.no) [178.232.111.229]:47277: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:42:58 host2 sshd[44220]: Disconnected from invalid user ec2-user 104.152.40.8 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-23 02:42:24 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:41814: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 02:42:27 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:50268: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-23 02:43:23 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:37352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:43:35 host2 sshd[44612]: Disconnected from invalid user steam 104.152.40.8 port 35892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 02:44:38 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:53894: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:44:46 host2 sshd[45251]: Disconnected from invalid user xy 104.152.40.8 port 60490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 23 02:45:59 host2 sshd[46315]: Disconnected from invalid user testuser 104.152.40.8 port 56860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 23 02:46:12 host2 sshd[46490]: Disconnected from invalid user k3 103.176.79.117 port 45436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:45:37 host2 sshd[46090]: Disconnected from invalid user a 152.200.205.179 port 51058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.153.185
country_id: 6252001
description:
Dec 23 02:46:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.84.153.185, lip=66.85.158.91, session=<XU+l8JBGEOwUVJm5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:46:29 host2 sshd[46660]: Disconnected from invalid user surin 20.212.241.39 port 56870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-23 02:46:37 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:42589: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:46:58 host2 sshd[47425]: Disconnected from invalid user liang 152.200.205.179 port 54884 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 02:47:51 host2 sshd[48263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:47:35 host2 sshd[48021]: Disconnected from invalid user kt 152.200.205.179 port 58344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 23 02:48:16 host2 sshd[48701]: Disconnected from invalid user deployer 103.255.147.244 port 52354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-23 02:47:27 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:47832: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Dec 23 02:48:51 host2 sshd[49155]: Disconnected from invalid user git 152.200.205.179 port 37446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 23 02:48:51 host2 sshd[49138]: Disconnected from invalid user deployer 103.255.147.244 port 53800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2025-12-23 02:50:06 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:46403: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-23 02:49:26 dovecot_login authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:52639: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:49:49 host2 sshd[49899]: Disconnected from invalid user nrk 20.212.241.39 port 40232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:50:39 host2 sshd[50799]: Disconnected from invalid user deployer 20.212.241.39 port 57068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Dec 23 02:51:29 host2 sshd[51470]: Disconnected from invalid user deployer 20.212.241.39 port 54816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:55:12 host2 sshd[55756]: Disconnected from invalid user frappe 94.182.134.73 port 54654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:55:46 host2 sshd[56343]: Disconnected from invalid user developer 94.182.134.73 port 54688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 02:56:16 host2 sshd[56776]: Disconnected from invalid user sae 94.182.134.73 port 54722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 02:56:36 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:56732: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 23 02:57:43 host2 sshd[58032]: Disconnected from invalid user user02 138.68.104.233 port 47120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 02:57:56 host2 sshd[58210]: Disconnected from invalid user hari 210.79.142.221 port 34584 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 03:00:02 host2 sshd[60161]: Received disconnect from 94.182.134.73 port 54984:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.73
country_id: 130758
description:
Dec 23 03:01:07 host2 sshd[61249]: Disconnected from invalid user admin 94.182.134.73 port 55054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 03:01:57 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43574: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:03:34 host2 sshd[63676]: Disconnected from invalid user tigergraph 210.79.142.221 port 40262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 03:05:08 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:47958: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.49
country_id: 3144096
description:
2025-12-23 03:05:08 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.13.49]:37063: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2025-12-23 03:05:28 dovecot_login authenticator failed for H=([127.0.0.1]) [120.157.246.158]:49428: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 03:06:33 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:55748: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:08:16 host2 sshd[68135]: Disconnected from invalid user developer 210.79.142.221 port 59472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 23 03:09:25 host2 sshd[69106]: Disconnected from invalid user admin 210.79.142.221 port 36416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 03:09:45 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:38354: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-23 03:11:14 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:44038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 03:11:58 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:44344: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 03:12:25 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:33582: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 03:12:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:48266: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 03:13:06 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:59608: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 03:13:49 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33444: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-23 03:15:31 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:38284: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.163.126
country_id: 6252001
description:
2025-12-23 03:15:39 dovecot_plain authenticator failed for H=(localhost) [192.3.163.126]:41998: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 03:15:40 host2 pure-ftpd[74918]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-23 03:16:17 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:45854: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 03:19:18 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:14816: 535 Incorrect authentication data (set_id=info@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 03:22:34 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:34934: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 03:24:06 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:37499: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-23 03:24:29 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:48836: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-23 03:25:30 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:43890: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-23 03:25:49 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:61494: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 03:27:03 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:60674: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:33:14 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:56660: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 03:33:29 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:10829: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:33:20 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:60090: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.253.68.102
country_id: 6252001
description:
[2025-12-23 03:34:35 +0530] info [webmaild] 162.253.68.102 - info@vtradelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 03:35:06 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:54938: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-23 03:36:10 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:46733: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-23 03:40:27 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:45072: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-23 03:40:45 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51108: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 03:41:52 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:44108: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-23 03:42:50 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:39986: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-23 03:43:01 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:52238: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-23 03:42:20 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:37135: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.27.59.170
country_id: 6252001
description:
2025-12-23 03:42:24 dovecot_login authenticator failed for H=(136-27-59-170.cab.webpass.net) [136.27.59.170]:48090: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.124.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.124.142: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 03:44:44 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:42510: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 03:49:40 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:46142: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 03:53:16 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:40456: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 03:53:23 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:50736: 535 Incorrect authentication data (set_id=info@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Dec 23 03:54:20 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<emkn4pFGBunEAHcC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.0.105.88
country_id: 2510769
description:
Dec 23 03:54:37 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=37.0.105.88, lip=66.85.158.91, TLS, session=<BOl+45FG8OYlAGlY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 03:54:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:37956: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 03:56:04 host2 sshd[114942]: Disconnected from invalid user ozzy 103.117.56.152 port 46384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 03:56:09 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:33146: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.147
country_id: 3865483
description:
Dec 23 03:58:12 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.249.147, lip=66.85.158.91, TLS, session=<N8zR75FGr8uzAPmT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.102.57.18
country_id: 3077311
description:
Dec 23 03:58:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=5.102.57.18, lip=66.85.158.91, TLS, session=<orRU8ZFG164FZjkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-23 04:00:16 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:38285: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-23 03:59:44 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [109.69.15.132]:48143: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 04:00:12 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:46986: 535 Incorrect authentication data (set_id=admin@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:00:38 host2 sshd[119929]: Disconnected from invalid user usman 164.92.106.89 port 42470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-23 04:02:06 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:56860: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 04:02:09 host2 sshd[121598]: Disconnected from invalid user administrator 103.117.56.152 port 53184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:01:48 host2 sshd[121292]: Disconnected from invalid user ehsan 164.92.106.89 port 56108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Dec 23 04:02:26 host2 sshd[121308]: Disconnected from invalid user bitrix 45.78.224.112 port 36738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 23 04:02:48 host2 sshd[122208]: Disconnected from invalid user admin 103.117.56.152 port 54652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Dec 23 04:03:01 host2 sshd[122472]: Disconnected from invalid user ubuntu 52.172.177.191 port 48014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-23 04:02:19 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:40456: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 04:03:44 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:43072: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 23 04:03:51 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y9t6BZJGUpBChJmM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.229.116.218
country_id: 6252001
description:
[2025-12-23 04:05:16 +0530] info [whostmgrd] 72.229.116.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 23 04:05:01 host2 sshd[124813]: Disconnected from invalid user nikola 164.92.106.89 port 41468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 04:05:30 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:43334: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Dec 23 04:09:06 host2 sshd[129173]: Disconnected from invalid user nikola 45.78.230.106 port 40006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 04:08:40 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:55986: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:10:07 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:59936: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 04:15:28 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:51372: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Dec 23 04:15:51 host2 sshd[137710]: Disconnected from invalid user prom 45.78.224.112 port 43616 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 04:17:47 host2 pure-ftpd[139887]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Dec 23 04:18:51 host2 sshd[141117]: Disconnected from invalid user ubuntu 45.78.230.106 port 44798 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.212.194.62
country_id: 3017382
description:
[2025-12-23 04:20:08 +0530] info [cpaneld] 173.212.194.62 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 04:20:45 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:51914: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 04:21:40 host2 sshd[144976]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-23 04:22:36 dovecot_login authenticator failed for H=(cm-178.232.138.184.get.no) [178.232.138.184]:59555: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-23 04:22:49 dovecot_login authenticator failed for H=([92.62.243.175]) [92.62.243.175]:52560: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-23 04:23:22 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:33405: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-23 04:22:26 dovecot_login authenticator failed for H=(201.172.26.3-clientes-izzi.mx) [201.172.26.3]:59833: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 04:23:50 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:41038: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Dec 23 04:24:21 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.124, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SGDHTpJGgMHG6xh8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:25:16 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:38884: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 04:25:24 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:36970: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.213.71.144
country_id: 6252001
description:
[2025-12-23 04:25:36 +0530] info [whostmgrd] 216.213.71.144 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-23 04:27:25 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:33882: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-12-23 04:27:37 dovecot_login authenticator failed for H=(49.207.9.39.actcorp.in) [49.207.9.39]:63084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 04:28:31 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:55826: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.189
country_id: 6252001
description:
2025-12-23 04:29:22 dovecot_plain authenticator failed for H=([10.29.18.199]) [84.239.43.189]:38641: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.43.189
country_id: 6252001
description:
2025-12-23 04:29:28 dovecot_login authenticator failed for H=([10.29.18.199]) [84.239.43.189]:38641: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 04:31:17 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:36506: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-23 04:30:36 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:53662: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 04:31:42 host2 sshd[157584]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 04:31:23 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:22166: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 04:31:44 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:41634: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 04:31:51 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:58182: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 04:32:05 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:36102: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2025-12-23 04:32:47 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:34046: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2025-12-23 04:33:15 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:51212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.195.188
country_id: 6252001
description:
Dec 23 04:35:44 host2 pure-ftpd[162230]: (?@20.127.195.188) [INFO] New connection from 20.127.195.188


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 23 04:36:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<r++me5JGWMSLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.161.107
country_id: 294640
description:
2025-12-23 04:37:03 dovecot_login authenticator failed for H=([85.159.161.107]) [85.159.161.107]:43633: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 23 04:37:14 host2 sshd[164048]: Disconnected from invalid user emma 41.223.40.78 port 43886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-12-23 04:37:17 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:50952: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 23 04:37:56 host2 sshd[164824]: Disconnected from invalid user kasia 41.223.40.78 port 48036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 04:38:09 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:46426: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-23 04:38:56 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:41128: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-23 04:38:26 dovecot_login authenticator failed for H=([103.111.109.194]) [103.111.109.194]:39922: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-23 04:40:00 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:40961: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-23 04:41:20 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:58720: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-23 04:41:04 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:58330: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 23 04:41:51 host2 pure-ftpd[168845]: (?@178.128.203.219) [INFO] New connection from 178.128.203.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 04:41:36 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:51562: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 23 04:41:44 host2 pure-ftpd[168716]: (?@178.128.203.219) [INFO] New connection from 178.128.203.219


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.37.97
country_id: 6252001
description:
Dec 23 04:43:17 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.37.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<b0mJkpJGCpkUoyVh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 04:49:03 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:33932: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 04:49:12 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:41126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-23 04:49:29 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:59740: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-23 04:50:42 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:50041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 04:52:08 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:33070: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-23 04:52:09 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:33838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 04:52:12 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6003: 535 Incorrect authentication data (set_id=admin@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.100.212
country_id: 6252001
description:
Dec 23 04:51:56 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.235.100.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PC14sZJGOoFK62TU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-12-23 04:52:35 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:52378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 23 04:52:49 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XjGWtJJGsH9ChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.5
country_id: 1733045
description:
2025-12-23 04:53:09 dovecot_login authenticator failed for H=([49.124.148.5]) [49.124.148.5]:44732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:53:11 host2 sshd[180646]: Disconnected from invalid user vyos 165.154.29.11 port 56618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:53:52 host2 sshd[181114]: Disconnected from invalid user runner 165.154.29.11 port 42392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 04:53:40 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:55594: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:55:14 host2 sshd[182536]: Disconnected from invalid user zk 165.154.29.11 port 42222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:55:52 host2 sshd[183339]: Disconnected from invalid user steam 165.154.29.11 port 56256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Dec 23 04:56:29 host2 sshd[183846]: Disconnected from invalid user cyril 165.154.29.11 port 42060 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 05:00:29 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:54944: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 05:03:27 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:53296: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.129.146
country_id: 6252001
description:
[2025-12-23 05:03:38 +0530] info [webmaild] 192.111.129.146 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-23 05:07:09 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-23 05:07:17 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:49909: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-23 05:07:39 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:36264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-23 05:07:42 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:38948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-23 05:09:16 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:35106: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 05:08:36 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:39554: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.127.24.165
country_id: 6252001
description:
2025-12-23 05:09:47 dovecot_login authenticator failed for H=99-127-24-165.lightspeed.chrlnc.sbcglobal.net [99.127.24.165]:39098: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 05:12:14 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:34818: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec 23 05:13:17 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.108, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kbbT/ZJGZsPG6xhs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 05:13:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:37218: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:15:06 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:34156: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 23 05:16:08 host2 sshd[200145]: Disconnected from invalid user daniel 202.165.15.132 port 40368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-23 05:16:14 dovecot_login authenticator failed for H=([177.236.149.116]) [177.236.149.116]:37061: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-23 05:15:45 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:41675: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-23 05:16:02 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:48600: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.132.127.172
country_id: 2750405
description:
2025-12-23 05:16:04 dovecot_plain authenticator failed for H=172-127-132-5.ftth.glasoperator.nl (localhost) [5.132.127.172]:52410: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-12-23 05:16:58 dovecot_login authenticator failed for H=([65.20.136.183]) [65.20.136.183]:45670: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-23 05:17:08 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:35107: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-23 05:17:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:45434: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Dec 23 05:18:10 host2 sshd[202255]: Disconnected from invalid user timemachine 45.78.203.124 port 47674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.228
country_id: 3865483
description:
Dec 23 05:19:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.228, lip=66.85.158.91, TLS, session=<rWRUEZNGYcKzAPzk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 05:20:04 host2 pure-ftpd[204084]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.100
country_id: 3469034
description:
Dec 23 05:19:31 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=187.120.72.100, lip=66.85.158.91, TLS, session=<UuC7EpNGzsK7eEhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:20:25 host2 sshd[204416]: Disconnected from invalid user element 206.81.27.245 port 37932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Dec 23 05:20:32 host2 sshd[204496]: Disconnected from invalid user sybase 45.78.203.124 port 50630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-23 05:22:04 dovecot_login authenticator failed for H=([190.104.24.6]) [190.104.24.6]:37552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:21:55 host2 sshd[205716]: Disconnected from invalid user in 36.91.166.34 port 52734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-23 05:22:54 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:55766: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:22:50 host2 sshd[206526]: Disconnected from invalid user gustavo 206.81.27.245 port 39680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.196
country_id: 3865483
description:
Dec 23 05:23:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.250.196, lip=66.85.158.91, TLS, session=</pvxIZNGX7yzAPrE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.212
country_id: 2963597
description:
Dec 23 05:24:01 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=89.106.141.212, lip=66.85.158.91, TLS, session=<7ck3I5NGds9Zao3U>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 23 05:24:29 host2 sshd[207983]: Disconnected from invalid user tmp 202.165.15.132 port 34058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 23 05:24:37 host2 sshd[208102]: Disconnected from invalid user subhana 206.81.27.245 port 42996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:24:46 host2 sshd[208214]: Disconnected from invalid user tmp 36.91.166.34 port 49802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Dec 23 05:25:29 host2 sshd[208916]: Disconnected from invalid user ilya 36.91.166.34 port 34970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 05:25:40 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:39436: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-23 05:25:44 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:7917: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 05:26:12 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:50878: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.253: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:26:59 host2 sshd[210330]: Disconnected from invalid user userftp 45.182.207.45 port 58182 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.253
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.253: 407 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:28:17 host2 sshd[211827]: Disconnected from invalid user cms 45.182.207.45 port 47262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-23 05:28:55 dovecot_login authenticator failed for H=([182.95.181.62]) [182.95.181.62]:33526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-23 05:28:33 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:41507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-23 05:29:28 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:49538: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:29:30 host2 sshd[212698]: Disconnected from invalid user safeuser 45.182.207.45 port 58668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-23 05:31:21 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:39443: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 23 05:30:43 host2 sshd[213758]: Disconnected from invalid user andrey 45.182.207.45 port 44858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.166.225
country_id: 1269750
description:
2025-12-23 05:31:39 dovecot_login authenticator failed for H=([103.250.160.76]) [117.198.166.225]:36182: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-23 05:32:00 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:36378: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-12-23 05:32:19 dovecot_login authenticator failed for H=107.93.206.77.rev.sfr.net [77.206.93.107]:54648: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2025-12-23 05:35:09 dovecot_login authenticator failed for H=([127.0.0.1]) [159.16.201.242]:56664: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2025-12-23 05:35:27 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.24]:53626: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.195.101.102
country_id: 6252001
description:
[2025-12-23 05:35:38 +0530] info [webmaild] 72.195.101.102 - info@colourmarklabels.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-23 05:36:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59745: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-23 05:42:54 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:60157: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 05:43:08 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:59696: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-23 05:42:41 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:57469: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-23 05:44:09 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:54154: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-23 05:44:25 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:35204: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 05:46:04 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44072: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:46:17 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:47034: 535 Incorrect authentication data (set_id=help@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-23 05:46:24 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:36942: 535 Incorrect authentication data (set_id=help@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-23 05:50:11 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:56720: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-23 05:50:33 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:46846: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 05:51:16 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:48462: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 05:51:24 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:60010: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.6.195.206
country_id: 6252001
description:
2025-12-23 05:58:33 dovecot_plain authenticator failed for H=(localhost) [50.6.195.206]:53386: 535 Incorrect authentication data (set_id=office@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-23 05:58:37 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:39194: 535 Incorrect authentication data (set_id=bostonlanka.com@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-23 05:59:38 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:61637: 535 Incorrect authentication data (set_id=bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 211.239.181.182
country_id: 1835841
description:
[2025-12-23 06:02:35 +0530] info [webmaild] 211.239.181.182 - info@essenceceylontea.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@essenceceylontea.com has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-23 06:03:03 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:50984: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-23 06:03:30 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:52296: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-23 06:03:25 dovecot_login authenticator failed for H=(187.161.136.72-clientes-izzi.mx) [187.161.136.72]:56749: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 23 06:05:24 host2 sshd[248040]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-23 06:06:48 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:41016: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-23 06:07:03 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:54150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 06:09:08 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:60456: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-23 06:09:10 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:39664: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.227.136.122
country_id: 1269750
description:
2025-12-23 06:09:16 dovecot_plain authenticator failed for H=(localhost) [64.227.136.122]:35646: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-23 06:09:38 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:59398: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-23 06:09:56 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.23.68]:42408: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-23 06:10:14 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.58.18]:38140: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 06:10:38 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:37314: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-23 06:10:51 dovecot_login authenticator failed for H=([188.124.142.221]) [188.124.142.221]:35367: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.190
country_id: 1733045
description:
2025-12-23 06:11:15 dovecot_login authenticator failed for H=([49.124.148.190]) [49.124.148.190]:50162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-23 06:12:33 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:53544: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-23 06:12:57 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:45248: 535 Incorrect authentication data (set_id=admin@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-23 06:13:01 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:57772: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-23 06:13:04 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:60619: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.248.169.6
country_id: 1643084
description:
[2025-12-23 06:13:17 +0530] info [webmaild] 23.248.169.6 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 06:13:33 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:55186: 535 Incorrect authentication data (set_id=office@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-23 06:13:16 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:33836: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-23 06:14:18 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:55172: 535 Incorrect authentication data (set_id=help@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.153.57
country_id: 1643084
description:
2025-12-23 06:15:08 dovecot_plain authenticator failed for H=(localhost) [113.11.153.57]:52686: 535 Incorrect authentication data (set_id=admin@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.47.37.18
country_id: 6252001
description:
2025-12-23 06:16:34 dovecot_login authenticator failed for H=([127.0.0.1]) [50.47.37.18]:40170: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-23 06:16:41 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:41757: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.232
country_id: 2395170
description:
Dec 23 06:18:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=154.127.36.232, lip=66.85.158.91, TLS, session=<BfGz5JNGUYiafyTo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-23 06:18:10 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:42409: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.208.225
country_id: 6251999
description:
2025-12-23 06:17:31 dovecot_plain authenticator failed for H=gain.tiqqed.com (localhost) [158.69.208.225]:52550: 535 Incorrect authentication data (set_id=info@melanifinefood.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.249.23
country_id: 3469034
description:
Dec 23 06:17:30 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.245.249.23, lip=66.85.158.91, TLS, session=<0JlL4pNG3Luq9fkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.91
country_id: 3469034
description:
Dec 23 06:17:49 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.240.36.91, lip=66.85.158.91, TLS, session=<7wWL45NGiN+/8CRb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.181
country_id: 3175395
description:
Dec 23 06:17:48 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.169.181, lip=66.85.158.91, TLS, session=<drOI45NGTZ65D6m1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-23 06:18:26 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:59680: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.249
country_id: 1733045
description:
2025-12-23 06:18:28 dovecot_login authenticator failed for H=([49.124.150.249]) [49.124.150.249]:57212: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-23 06:18:39 dovecot_plain authenticator failed for H=(localhost) [47.88.19.82]:57216: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-23 06:21:13 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:47688: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-23 06:21:48 dovecot_login authenticator failed for H=([188.59.19.112]) [188.59.19.112]:57434: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-23 06:22:04 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:39924: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.17
country_id: 3175395
description:
Dec 23 06:22:25 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=195.177.113.17, lip=66.85.158.91, TLS, session=</u4A9JNGQoTDsXER>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 23 06:22:36 host2 pure-ftpd[263931]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.251
country_id: 732800
description:
Dec 23 06:22:43 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.255.212.251, lip=66.85.158.91, TLS, session=<WjYd9ZNG+9q5/9T7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-23 06:24:00 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:45610: 535 Incorrect authentication data (set_id=hr@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.232.179.250
country_id: 1269750
description:
2025-12-23 06:25:27 dovecot_plain authenticator failed for H=(localhost) [165.232.179.250]:49764: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 23 06:26:24 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<aZwiA5RGgsPBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-23 06:27:47 dovecot_login authenticator failed for H=([127.0.0.1]) [109.237.113.106]:54094: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-23 06:28:05 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.170]:32942: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:10 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:58130: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-23 06:33:18 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:43978: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-23 06:33:48 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:54668: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-23 06:34:03 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:59025: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-23 06:35:09 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:49691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-23 06:35:26 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:46567: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:12 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:59138: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.148.72.41
country_id: 6252001
description:
2025-12-23 06:37:18 dovecot_plain authenticator failed for H=41.72.148.132.host.secureserver.net (localhost) [132.148.72.41]:58624: 535 Incorrect authentication data (set_id=news@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-12-23 06:39:27 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-23 06:39:42 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:4036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-23 06:39:58 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:24086: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-23 06:40:04 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:60164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2025-12-23 06:40:23 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:37098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-23 06:40:50 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:45643: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-23 06:41:12 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:55236: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-23 06:41:34 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36212: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.91.124.142
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.91.124.142: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-23 06:46:59 dovecot_login authenticator failed for H=([127.0.0.1]) [24.232.114.16]:43807: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-23 06:47:33 dovecot_login authenticator failed for H=([127.0.0.1]) [84.211.7.17]:55291: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:49:05 host2 sshd[289683]: Disconnected from invalid user kocom 194.87.187.47 port 34888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 23 06:50:11 host2 sshd[290843]: Disconnected from invalid user testuser 194.87.187.47 port 48142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-23 06:50:33 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:38848: 535 Incorrect authentication data (set_id=office@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-23 06:53:03 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:13978: 535 Incorrect authentication data (set_id=test@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-23 06:54:09 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:54926: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-23 06:55:54 +0530] info [webmaild] 185.205.186.84 - isuru@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Dec 23 06:58:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS, session=<BL5SdpRGrPrN0h/c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-23 06:58:44 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:45622: 535 Incorrect authentication data (set_id=sales@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-23 06:59:02 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:57622: 535 Incorrect authentication data (set_id=office@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:00:17 host2 sshd[303569]: Disconnected from invalid user user 154.124.97.102 port 59599 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:02:36 host2 sshd[306423]: Disconnected from invalid user admin 103.144.247.233 port 34230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 23 07:03:12 host2 sshd[307300]: Disconnected from invalid user test 103.144.247.233 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-23 07:04:55 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:48814: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 23 07:04:21 host2 sshd[308512]: Disconnected from invalid user steam 154.124.97.102 port 35893 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:38 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<PakGjJRGIoqlms6L>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.206.139
country_id: 6252001
description:
Dec 23 07:04:39 host2 dovecot[3805015]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.206.139, lip=66.85.158.92, session=<ghUXjJRGsoqlms6L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.129.230.30
country_id: 1814991
description:
2025-12-23 07:04:45 dovecot_plain authenticator failed for H=(localhost) [8.129.230.30]:44236: 535 Incorrect authentication data (set_id=office@nsteeleng.com)


