# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-11-11 23:11:40 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:38753: 535 Incorrect authentication data (set_id=it@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-11 23:13:09 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:48896: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.143.226.68
country_id: 3686110
description:
Nov 11 23:13:32 host2 sshd[1150026]: Disconnected from invalid user webserver 181.143.226.68 port 37226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-11-11 23:13:34 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:57888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.196
country_id: 2635167
description:
Nov 11 23:13:34 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.196, lip=66.85.158.92, TLS, session=<YSndL1VDJY9X7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.197
country_id: 2635167
description:
Nov 11 23:13:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.197, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aMjpL1VDxcdX7LDF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-11-11 23:13:49 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:53140: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.187
country_id: 2635167
description:
Nov 11 23:14:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.187, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<yFvlMVVDVZ2594m7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.61.156
country_id: 1269750
description:
2025-11-11 23:13:25 dovecot_login authenticator failed for ([103.177.205.100]) [58.84.61.156]:9739: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.209
country_id: 2635167
description:
Nov 11 23:14:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.209, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<ZcngM1VDPZRX7LDR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.199
country_id: 2635167
description:
Nov 11 23:15:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.199, lip=66.85.158.92, TLS handshaking: Connection closed, session=<a/vbNVVDyc1X7LDH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 11 23:15:34 host2 sshd[1152335]: Disconnected from invalid user zjw 194.107.115.2 port 55216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.191
country_id: 2635167
description:
Nov 11 23:15:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.191, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Kj3cN1VDlee594m/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.106
country_id: 1605651
description:
2025-11-11 23:16:09 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [182.53.55.106]:50291: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov 11 23:16:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hVLTOVVD861X7LDC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.83.51.57
country_id: 1269750
description:
2025-11-11 23:16:30 dovecot_login authenticator failed for (broadband.actcorp.in) [183.83.51.57]:55014: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-11-11 23:16:46 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:55087: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.189
country_id: 2635167
description:
Nov 11 23:16:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.189, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<F7vQO1VDYbm594m9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.182
country_id: 2635167
description:
Nov 11 23:18:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.182, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<PnnFP1VDX86594m2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.187
country_id: 2635167
description:
Nov 11 23:17:28 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.187, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nAjMPVVDiYpX7LC7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.200
country_id: 2635167
description:
Nov 11 23:18:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.200, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<CtfAQVVDD+W594nI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 11 23:18:43 host2 sshd[1154367]: Disconnected from invalid user newftpuser 177.130.248.114 port 45890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.143.226.68
country_id: 3686110
description:
Nov 11 23:19:13 host2 sshd[1154637]: Disconnected from invalid user wireguard 181.143.226.68 port 46360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 11 23:19:49 host2 sshd[1154939]: Disconnected from invalid user newftpuser 194.107.115.2 port 59578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.143.226.68
country_id: 3686110
description:
Nov 11 23:20:39 host2 sshd[1155725]: Disconnected from invalid user lek 181.143.226.68 port 34236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 11 23:21:18 host2 sshd[1156044]: Disconnected from invalid user odoo 194.107.115.2 port 31616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 11 23:23:45 host2 sshd[1157734]: Disconnected from invalid user odoo 177.130.248.114 port 36866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 11 23:24:18 host2 sshd[1158143]: Disconnected from invalid user apt 162.223.91.130 port 42518 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 11 23:25:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, session=<jcjfWFVD5oC4affD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 11 23:25:35 host2 sshd[1159206]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 11 23:25:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.91, TLS: Connection closed, session=<pH26WVVDhCG4affD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 11 23:25:21 host2 sshd[1159053]: Disconnected from invalid user zhangyue 162.223.91.130 port 41454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.154
country_id: 3469034
description:
2025-11-11 23:26:54 dovecot_login authenticator failed for ([127.0.0.1]) [186.227.91.154]:40895: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.160.203.96
country_id: 1861060
description:
2025-11-11 23:26:39 dovecot_login authenticator failed for p6032-ipngnfx01funabasi.chiba.ocn.ne.jp ([127.0.0.1]) [114.160.203.96]:62568: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 11 23:29:11 host2 sshd[1161375]: Disconnected from invalid user hillary 62.60.131.157 port 24635 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.100
country_id: 357994
description:
2025-11-11 23:31:41 dovecot_login authenticator failed for (ADMIN) [188.214.122.100]:2966: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.130.248.114
country_id: 3469034
description:
Nov 11 23:32:47 host2 sshd[1163511]: Disconnected from invalid user zjw 177.130.248.114 port 39202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-11-11 23:35:10 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:45908: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-11 23:35:23 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:52032: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-11 23:38:34 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:57482: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-11 23:38:49 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:59634: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.11
country_id: 6252001
description:
Nov 11 23:42:18 host2 pure-ftpd[1169126]: (?@172.105.128.11) [INFO] New connection from 172.105.128.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-11 23:47:49 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:41240: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-11-11 23:48:20 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:60710: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 11 23:51:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<zt/lt1VDtJqLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 11 23:57:19 host2 sshd[1180772]: Disconnected from invalid user admin 2.57.121.112 port 11541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-12 00:00:14 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:47628: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-12 00:01:02 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:62956: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-12 00:01:12 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:38043: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-11-12 00:01:14 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:55912: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-12 00:01:21 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:53741: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-12 00:01:35 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:54406: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-12 00:01:48 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:35899: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-12 00:02:08 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:56456: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 00:06:28 host2 sshd[1187770]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:07:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<843A71VD+qgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:08:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<unfB8lVDNu4DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 12 00:08:46 host2 sshd[1188880]: Disconnected from invalid user admin 198.98.56.205 port 42894 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:09:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<xQF0+FVDPKYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.75
country_id: 2658434
description:
2025-11-12 00:10:40 dovecot_login authenticator failed for (ADMIN) [158.173.152.75]:61261: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 12 00:12:13 host2 sshd[1191190]: Disconnected from invalid user chenhui 198.98.56.205 port 44920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:11:59 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0wfDAFZDcuADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:12:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<uJvmAlZDYtkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:13:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<4DOEBlZDPs4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:15:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<puedC1ZDyr4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:16:02 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<86M7D1ZDmo4DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 12 00:16:28 host2 sshd[1194113]: Disconnected from invalid user test1 198.98.56.205 port 43164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Nov 12 00:17:34 host2 sshd[1194690]: Disconnected from invalid user ts3 198.98.56.205 port 52822 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-11-12 00:17:20 +0530] info [cpaneld] 149.30.139.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:17:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ww8bFFZDhpkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 00:18:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58813: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:20:06 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<HwfKHVZD2r4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.150.123
country_id: 1269750
description:
Nov 12 00:19:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.65.150.123, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DPxVHFZDBtifQZZ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.40
country_id: 6252001
description:
Nov 12 00:20:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.40, lip=66.85.158.92, session=<nKoMIFZD95lBMQEo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Nov 12 00:20:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.38, lip=66.85.158.92, TLS: Connection closed, session=<OEzTIFZDcMhBMQEm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 12 00:20:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<v2jgH1ZD2g5APsVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:21:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XgiDIlZDLN0DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2025-11-12 00:21:56 dovecot_login authenticator failed for ([49.124.220.98]) [49.124.220.98]:56344: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-11-12 00:22:15 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:33397: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 00:24:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<IBxqLFZD1N4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.156.233.76
country_id: 3175395
description:
Nov 12 00:24:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.156.233.76, lip=66.85.158.91, TLS, session=<BymQLFZDTNS5nOlM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.224.171.103
country_id: 3469034
description:
Nov 12 00:24:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.224.171.103, lip=66.85.158.91, TLS, session=<ulmxLVZDq50t4Ktn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.63
country_id: 2635167
description:
Nov 12 00:25:32 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.63, lip=66.85.158.92, TLS, session=<9lk+MVZDT5FX7LA/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.231
country_id: 6252001
description:
Nov 12 00:26:08 host2 pure-ftpd[1199405]: (?@205.210.31.231) [INFO] New connection from 205.210.31.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-12 00:30:46 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:55658: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-11-12 00:30:28 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:50610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.207.202
country_id: 6252001
description:
Nov 12 00:30:33 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.207.202, lip=66.85.158.92, session=<qZspQ1ZDKN+s6s/K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-11-12 00:32:01 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:38378: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-12 00:32:17 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:58752: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-11-12 00:34:04 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:38498: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.196
country_id: 6252001
description:
Nov 12 00:34:06 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.196, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VZ/kT1ZD40pAPsXE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.145.136
country_id: 6252001
description:
2025-11-12 00:33:57 dovecot_login authenticator failed for (ADMIN) [102.129.145.136]:44540: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-12 00:34:46 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:60564: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Nov 12 00:34:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+lQSUVZDAGZAPsW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Nov 12 00:36:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.71, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<i3PLVlZD/9fG6xhH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.83
country_id: 2635167
description:
Nov 12 00:39:09 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.83, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cyLnYVZDW4S594lT>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.44
country_id: 2635167
description:
Nov 12 00:39:07 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.44, lip=66.85.158.91, TLS, session=<mgXPYVZDT9JX7LAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Nov 12 00:39:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Vm3iY1ZDda1X7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.100
country_id: 2635167
description:
Nov 12 00:40:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.100, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<L8XdZVZDr9VX7LBk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov 12 00:40:48 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<RzfZZ1ZDycRX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 12 00:41:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<v2LUaVZDQZi594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.87
country_id: 2635167
description:
Nov 12 00:41:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.87, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<h8TNa1ZDw49X7LBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Nov 12 00:42:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<LvfKbVZDrZO594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Nov 12 00:43:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<k1/Gb1ZDW7hX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.101
country_id: 2635167
description:
Nov 12 00:44:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<YUW7c1ZD49xX7LBl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.107
country_id: 2635167
description:
Nov 12 00:43:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.107, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=</M6/cVZDtai594lr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.77.77.35
country_id: 1814991
description:
2025-11-12 00:49:43 dovecot_login authenticator failed for (ZigP0o) [49.77.77.35]:49688: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.77.77.35
country_id: 1814991
description:
2025-11-12 00:50:31 dovecot_login authenticator failed for (K0T5Lqx8YV) [49.77.77.35]:50876: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.77.77.35
country_id: 1814991
description:
2025-11-12 00:51:18 dovecot_login authenticator failed for (K0PvU7jrDG) [49.77.77.35]:52159: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.221.254.177
country_id: 798544
description:
Nov 12 00:56:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=85.221.254.177, lip=66.85.158.91, TLS, session=<iPYIoFZD+7xV3f6x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.125.133
country_id: 2215636
description:
Nov 12 00:57:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=165.16.125.133, lip=66.85.158.91, TLS, session=<PLwwoVZDXealEH2F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.64
country_id: 6252001
description:
2025-11-12 00:57:33 dovecot_login authenticator failed for (ADMIN) [158.173.153.64]:33475: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 01:00:49 host2 sshd[1221206]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-12 01:01:47 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:49812: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 12 01:06:57 host2 sshd[1224612]: Disconnected from invalid user lhy 79.6.62.97 port 56256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2025-11-12 01:09:24 dovecot_login authenticator failed for ([49.124.220.98]) [49.124.220.98]:60122: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-12 01:09:36 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:57672: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2025-11-12 01:12:09 dovecot_login authenticator failed for ([49.124.151.67]) [49.124.151.67]:45868: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-12 01:15:56 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:46637: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 01:16:57 host2 sshd[1230528]: Disconnected from invalid user admin 2.57.121.112 port 25195 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.72
country_id: 6252001
description:
Nov 12 01:17:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.72, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7RWO6VZDZdzN0h9I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-12 01:17:10 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:49725: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-12 01:17:32 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:51616: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.6.62.97
country_id: 3175395
description:
Nov 12 01:17:19 host2 sshd[1230711]: Disconnected from invalid user vpn 79.6.62.97 port 59940 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.135
country_id: 3469034
description:
Nov 12 01:18:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=190.89.137.135, lip=66.85.158.91, TLS, session=<WUlE7lZDCei+WYmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.49
country_id: 798544
description:
Nov 12 01:19:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.49, lip=66.85.158.91, TLS, session=<7TSB71ZD36gu4ycx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.156
country_id: 1562822
description:
2025-11-12 01:24:41 dovecot_login authenticator failed for (ADMIN) [173.239.247.156]:18519: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 12 01:25:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Y975BldDYsjG6xhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-12 01:29:50 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:46900: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.180.146.145
country_id: 6252001
description:
Nov 12 01:29:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.180.146.145, lip=66.85.158.91, session=<AC81F1dDssQ0tJKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-11-12 01:30:10 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:59771: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.187
country_id: 6252001
description:
Nov 12 01:31:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.174.187, lip=66.85.158.92, session=<2r7VHldDlucofK67>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 01:41:40 host2 sshd[1243581]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.102.12
country_id: 290557
description:
2025-11-12 01:42:53 dovecot_login authenticator failed for (ADMIN) [146.70.102.12]:8397: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 12 01:58:12 host2 sshd[1253563]: Disconnected from invalid user super 186.233.118.22 port 38612 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-12 01:58:38 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 02:00:32 host2 sshd[1255173]: Disconnected from invalid user kinsey 62.60.131.157 port 35176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 12 02:01:33 host2 sshd[1255636]: Disconnected from invalid user appuser 186.233.118.22 port 39152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-11-12 02:02:09 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:34872: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2025-11-12 02:02:32 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:57912: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-12 02:02:49 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:33026: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-11-12 02:05:15 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:40118: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.122.170
country_id: 2661886
description:
2025-11-12 02:04:23 dovecot_login authenticator failed for h-155-4-122-170.a259.priv.bahnhof.se [155.4.122.170]:57446: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-12 02:04:38 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:38016: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 12 02:07:06 host2 sshd[1258986]: Disconnected from invalid user invitado 186.233.118.22 port 47604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-12 02:10:37 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:45890: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-12 02:12:11 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:32858: 535 Incorrect authentication data (set_id=subscribe@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-12 02:13:09 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:60452: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.127
country_id: 1269750
description:
Nov 12 02:15:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.18.166.127, lip=66.85.158.91, TLS, session=<J6+OuVdD1aFnEqZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.62
country_id: 3175395
description:
Nov 12 02:15:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=185.197.9.62, lip=66.85.158.91, TLS, session=<XBzYuldDO+C5xQk+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-11-12 02:20:44 dovecot_login authenticator failed for ([125.21.105.49]) [128.185.219.2]:52440: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-12 02:20:59 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:36791: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.204.248
country_id: 1880251
description:
Nov 12 02:30:28 host2 sshd[1272199]: Disconnected from invalid user hadi 45.78.204.248 port 35888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.248
country_id: 1880251
description:
Nov 12 02:33:07 host2 sshd[1273509]: Disconnected from invalid user gitlab-runner 45.78.204.248 port 33456 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 02:35:52 host2 sshd[1275292]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 02:35:38 host2 sshd[1275145]: Disconnected from invalid user admin 2.57.121.112 port 27300 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.212.55
country_id: 6251999
description:
Nov 12 02:36:44 host2 pure-ftpd[1275635]: (?@148.113.212.55) [INFO] New connection from 148.113.212.55


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.212.55
country_id: 6251999
description:
Nov 12 02:36:57 host2 pure-ftpd[1275763]: (?@148.113.212.55) [INFO] New connection from 148.113.212.55


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 12 02:43:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<2VpbHlhDYpi58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.27
country_id: 732800
description:
2025-11-12 02:50:30 dovecot_login authenticator failed for (ADMIN) [94.156.14.27]:4367: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 12 02:52:17 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<7CYQPlhD8Na58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-12 02:58:00 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:21587: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-12 02:57:44 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:38778: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.251.245.20
country_id: 6252001
description:
[2025-11-12 02:59:56 +0530] info [cpaneld] 104.251.245.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.140.55
country_id: 6252001
description:
[2025-11-12 02:59:28 +0530] info [cpaneld] 174.160.140.55 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.113.58.143
country_id: 6252001
description:
[2025-11-12 02:59:34 +0530] info [cpaneld] 166.113.58.143 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.167.133.152
country_id: 6252001
description:
[2025-11-12 02:59:36 +0530] info [cpaneld] 174.167.133.152 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.203.224.249
country_id: 6252001
description:
[2025-11-12 02:59:38 +0530] info [whostmgrd] 108.203.224.249 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.67.242
country_id: 6252001
description:
[2025-11-12 02:59:46 +0530] info [cpaneld] 172.56.67.242 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 4.36.14.66
country_id: 6252001
description:
[2025-11-12 02:59:54 +0530] info [cpaneld] 4.36.14.66 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 166.88.101.185
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 166.88.101.185: 313 connections per 30 seconds to 587 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.123
country_id: 2960313
description:
2025-11-12 03:14:56 dovecot_login authenticator failed for (ADMIN) [37.46.113.123]:65125: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 03:16:50 host2 sshd[1301275]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-12 03:23:26 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:38704: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-12 03:23:47 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:45508: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 03:24:14 host2 sshd[1306598]: Disconnected from invalid user admin 2.57.121.112 port 14399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 12 03:24:53 host2 sshd[1306917]: Disconnected from invalid user admin 45.78.230.106 port 43372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 12 03:29:18 host2 sshd[1310566]: Disconnected from invalid user user1 27.111.32.174 port 52262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 12 03:30:39 host2 sshd[1311545]: Disconnected from invalid user dave 27.111.32.174 port 52150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 12 03:31:53 host2 sshd[1312448]: Disconnected from invalid user adrian 27.111.32.174 port 52286 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.109
country_id: 6252001
description:
Nov 12 03:34:22 host2 pure-ftpd[1313749]: (?@198.235.24.109) [INFO] New connection from 198.235.24.109


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 12 03:35:53 host2 sshd[1315009]: Disconnected from invalid user sam 27.111.32.174 port 58762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.159
country_id: 2921044
description:
2025-11-12 03:37:42 dovecot_login authenticator failed for (ADMIN) [191.101.157.159]:44760: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 12 03:37:16 host2 sshd[1315851]: Disconnected from invalid user loguser 27.111.32.174 port 49878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-12 03:44:03 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:41638: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Nov 12 03:49:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<QXnJCVlDjA6nXpIy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 03:53:50 host2 sshd[1329504]: Disconnected from invalid user admin 2.57.121.112 port 52641 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-11-12 03:54:27 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:58236: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-11-12 03:54:41 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:50018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Nov 12 03:54:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.124, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VCyBHVlDHtbG6xh8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.167
country_id: 3175395
description:
Nov 12 03:56:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.15.171.167, lip=66.85.158.91, TLS, session=<5+ANIVlDWZK5D6un>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.144
country_id: 1269750
description:
Nov 12 03:56:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=103.8.118.144, lip=66.85.158.91, TLS, session=<rmMzIllDEOBnCHaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.207
country_id: 3077311
description:
2025-11-12 04:00:31 dovecot_login authenticator failed for (ADMIN) [212.102.39.207]:30753: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-12 04:02:55 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:41816: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-12 04:03:42 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:37768: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 04:03:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-12 04:03:10 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:49656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-12 04:03:25 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:53803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.229.220.185
country_id: 6251999
description:
2025-11-12 04:07:11 dovecot_login authenticator failed for ([199.229.220.185]) [199.229.220.185]:51784: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.52
country_id: 1733045
description:
2025-11-12 04:07:30 dovecot_login authenticator failed for ([49.124.149.52]) [49.124.149.52]:58450: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 04:10:48 host2 sshd[1344466]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 12 04:11:38 host2 sshd[1345257]: Disconnected from invalid user adrian 45.78.230.106 port 36910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.31
country_id: 953987
description:
Nov 12 04:13:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.129.53.31, lip=66.85.158.91, TLS, session=<4vtaXllDwIpmgTUf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 12 04:14:36 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.92, session=<xzBqZFlDEMas7ORz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 12 04:16:48 host2 sshd[1350158]: Disconnected from invalid user gmbh 45.78.230.106 port 42944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 12 04:22:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=</wU1f1lD5sOnXpI4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 12 04:22:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS, session=<ld7cf1lD6BanXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.6
country_id: 2589581
description:
2025-11-12 04:22:28 dovecot_login authenticator failed for (ADMIN) [176.125.228.6]:52305: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-12 04:26:41 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:44348: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-12 04:27:44 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:39866: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-12 04:27:30 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:34012: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-12 04:32:51 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-11-12 04:34:57 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:47916: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-12 04:39:46 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:59276: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-12 04:40:09 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:59914: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.202
country_id: 1733045
description:
2025-11-12 04:40:22 dovecot_login authenticator failed for ([49.124.149.202]) [49.124.149.202]:48712: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-11-12 04:40:40 dovecot_login authenticator failed for (128.102.88.80.sta.ac-net.se) [80.88.102.128]:45200: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-12 04:44:10 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:36816: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.108.76
country_id: 6252001
description:
[2025-11-12 04:43:35 +0530] info [whostmgrd] 141.239.108.76 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-12 04:44:36 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:39843: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.63.48
country_id: 6252001
description:
[2025-11-12 04:44:56 +0530] info [whostmgrd] 50.158.63.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 04:49:56 host2 sshd[1382171]: Disconnected from invalid user yazmin 62.60.131.157 port 63717 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.11
country_id: 3042225
description:
2025-11-12 04:50:24 dovecot_login authenticator failed for (ADMIN) [91.90.124.11]:45496: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 04:51:17 host2 sshd[1383240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-11-12 04:58:29 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:54039: 535 Incorrect authentication data (set_id=promo@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 12 04:58:09 host2 sshd[1387957]: Disconnected from invalid user george 103.153.190.105 port 37818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 12 05:01:13 host2 sshd[1389775]: Disconnected from invalid user valheim 103.153.190.105 port 37133 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 12 05:04:11 host2 sshd[1391584]: Disconnected from invalid user admin 103.153.190.105 port 59379 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-12 05:06:05 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:54406: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-12 05:06:45 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:48326: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.58
country_id: 1814991
description:
2025-11-12 05:13:03 dovecot_login authenticator failed for (ADMIN) [188.241.80.58]:30133: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.235
country_id: 1269750
description:
Nov 12 05:13:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=122.187.229.235, lip=66.85.158.91, session=<tnWdOFpDnJV6u+Xr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Nov 12 05:14:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, TLS, session=<FUz0OFpDnKK0vP2W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.62.243.174
country_id: 732800
description:
Nov 12 05:14:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<587hr>, method=PLAIN, rip=92.62.243.174, lip=66.85.158.91, session=<c+SzOlpD1dVcPvOu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-12 05:15:51 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:15416: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-11-12 05:16:17 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:36962: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 05:27:51 host2 sshd[1404280]: Disconnected from invalid user anton 62.60.131.157 port 49894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-12 05:29:14 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:35734: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-12 05:29:29 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:41034: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.98.44
country_id: 3469034
description:
Nov 12 05:36:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=191.240.98.44, lip=66.85.158.91, TLS, session=<HNZlh1pD/6G/8GIs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.132
country_id: 3469034
description:
Nov 12 05:36:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.85.104.132, lip=66.85.158.91, TLS, session=<7io/iVpDK+S7VWiE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-12 05:40:09 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:45800: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.98
country_id: 6252001
description:
2025-11-12 05:42:24 dovecot_login authenticator failed for (ADMIN) [173.244.56.98]:44538: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-11-12 05:42:24 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:55318: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 05:45:15 host2 sshd[1414643]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-12 05:56:27 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:34298: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-11-12 05:56:43 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:50661: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-12 05:57:06 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:49848: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-12 06:02:04 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:58135: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-12 06:02:27 dovecot_login authenticator failed for (nsg-static-121.108.76.182-airtel.com) [182.78.159.82]:51506: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.140
country_id: 783754
description:
2025-11-12 06:05:47 dovecot_login authenticator failed for (ADMIN) [31.171.154.140]:49692: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.91.102.116
country_id: 2328926
description:
Nov 12 06:09:55 host2 sshd[1430959]: Invalid user cloudtourssrilan_travel from 102.91.102.116 port 53962


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-12 06:17:23 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:58013: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-11-12 06:17:53 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:46206: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.50.100.146
country_id: 2077456
description:
2025-11-12 06:26:22 dovecot_login authenticator failed for 146.100.50.210.sta.wbroadband.net.au [210.50.100.146]:50880: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.169
country_id: 6252001
description:
2025-11-12 06:27:19 dovecot_login authenticator failed for (ADMIN) [102.129.152.169]:56694: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-12 06:26:42 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:55566: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-12 06:27:02 dovecot_login authenticator failed for ([87.200.226.113]) [87.200.226.113]:42264: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 06:27:52 host2 sshd[1441680]: Disconnected from invalid user admin 2.57.121.112 port 63255 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.201
country_id: 3175395
description:
Nov 12 06:32:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.201, lip=66.85.158.91, TLS, session=<2bojUFtDfK3ZGrPJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.133
country_id: 1269750
description:
Nov 12 06:32:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.172.11.133, lip=66.85.158.91, TLS, session=<EIZKUVtDmqNnrAuF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 12 06:34:48 host2 sshd[1446948]: Disconnected from invalid user john 68.183.93.67 port 46922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.3
country_id: 1880251
description:
Nov 12 06:35:48 host2 sshd[1447795]: Disconnected from invalid user nextcloud 101.47.160.3 port 55562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 12 06:37:20 host2 sshd[1448789]: Disconnected from invalid user lana 68.183.93.67 port 45966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 12 06:44:37 host2 sshd[1453761]: Disconnected from invalid user admin 68.183.93.67 port 34320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.93
country_id: 6252001
description:
Nov 12 06:45:20 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.93, lip=66.85.158.91, TLS: Connection closed, session=<cgiFf1tDUqXHLZtd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 12 06:46:11 host2 sshd[1455291]: Disconnected from invalid user guest 68.183.93.67 port 33130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-12 06:47:18 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:60828: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-12 06:48:12 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:33450: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Nov 12 06:48:40 host2 sshd[1456590]: Disconnected from invalid user maill 36.66.16.233 port 33578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.96.146.250
country_id: 6252001
description:
2025-11-12 06:48:54 dovecot_login authenticator failed for ([157.96.146.250]) [157.96.146.250]:44200: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-12 06:49:16 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:46126: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.66.16.233
country_id: 1643084
description:
Nov 12 06:50:04 host2 sshd[1457626]: Disconnected from invalid user david 36.66.16.233 port 33400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:51:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<VXXVlFtDIsUDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-12 06:52:19 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:56421: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:51:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NO55lltDbpwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-12 06:51:50 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:45002: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.227
country_id: 1819730
description:
2025-11-12 06:52:00 dovecot_login authenticator failed for (ADMIN) [86.107.104.227]:3779: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:53:52 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<Da4MnltDZuEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:55:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mrGspFtDlOcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:57:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Qr1PqVtDEpEDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.55.72
country_id: 6252001
description:
Nov 12 06:57:23 host2 sshd[1463114]: Disconnected from invalid user jorge 107.174.55.72 port 46074 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:58:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<8PPFrVtDFrwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 12 06:58:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<YDaPr1tDOLEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.3
country_id: 1880251
description:
Nov 12 06:58:54 host2 sshd[1463776]: Disconnected from invalid user guest 101.47.160.3 port 44910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Nov 12 07:01:22 host2 sshd[1465978]: Disconnected from invalid user ubuntu 107.174.55.72 port 36396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2025-11-12 07:03:18 dovecot_login authenticator failed for (177-174-106-155.user.vivozap.com.br) [177.174.106.155]:42354: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Nov 12 07:03:18 host2 sshd[1467795]: Disconnected from invalid user postgres 107.174.55.72 port 49356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-12 07:03:28 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:10698: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 12 07:04:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS: Connection closed, session=<Yx/Pw1tDtDVChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.3
country_id: 1880251
description:
Nov 12 07:06:13 host2 sshd[1469346]: Disconnected from invalid user rob 101.47.160.3 port 35298 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.20
country_id: 1605651
description:
Nov 12 07:09:39 host2 pure-ftpd[1471325]: (?@103.176.152.20) [INFO] New connection from 103.176.152.20


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.160.3
country_id: 1880251
description:
Nov 12 07:16:05 host2 sshd[1475821]: Disconnected from invalid user ahmed 101.47.160.3 port 51810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2025-11-12 07:16:19 dovecot_login authenticator failed for (193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:57760: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.52
country_id: 99237
description:
2025-11-12 07:16:31 dovecot_login authenticator failed for ([62.201.212.52]) [62.201.212.52]:58730: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.92
country_id: 6252001
description:
2025-11-12 07:17:12 dovecot_login authenticator failed for (ADMIN) [191.96.67.92]:16672: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.135.155.254
country_id: 6252001
description:
[2025-11-12 07:27:40 +0530] info [whostmgrd] 72.135.155.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-12 07:29:09 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:48234: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 07:31:23 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65361: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 12 07:33:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, session=<eQLrKlxDWDRAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 12 07:33:20 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<lP8jK1xDvoJBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 12 07:33:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, TLS: Connection closed, session=<lQANLFxDwFhBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 12 07:33:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, TLS: Connection closed, session=<3f3AK1xDwmFAPpyY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 07:35:00 host2 sshd[1487094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 12 07:35:08 host2 sshd[1487409]: Disconnected from invalid user ubuntu 69.49.246.176 port 52538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 12 07:36:33 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<yaCxNlxDtC5ChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 12 07:38:10 host2 sshd[1489017]: Disconnected from invalid user max 69.49.246.176 port 46116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-11-12 07:41:16 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:54042: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 12 07:41:54 host2 sshd[1491476]: Disconnected from invalid user lab 69.49.246.176 port 52904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.52
country_id: 1880251
description:
2025-11-12 07:43:30 dovecot_login authenticator failed for (ADMIN) [156.146.57.52]:56447: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 07:44:26 host2 sshd[1492998]: Disconnected from invalid user admin 2.57.121.112 port 60562 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-11-12 07:46:42 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:38882: 535 Incorrect authentication data (set_id=help@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-12 07:47:11 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:36672: 535 Incorrect authentication data (set_id=help)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-12 07:48:13 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:36014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-11-12 07:48:21 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:36978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.169
country_id: 6252001
description:
Nov 12 07:50:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.169, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<idxOaFxDb87N0h+p>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 07:53:18 host2 sshd[1498205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.112.241
country_id: 2510769
description:
Nov 12 07:53:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.156.112.241, lip=66.85.158.91, TLS, session=<aDlscVxDF5GynHDx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.72
country_id: 1269750
description:
Nov 12 07:52:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.18.166.72, lip=66.85.158.91, TLS, session=<nkw0cFxD049nEqZI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-11-12 07:53:39 dovecot_login authenticator failed for (abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:34736: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-11-12 07:53:56 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:39538: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-12 08:03:12 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:42590: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-12 08:05:39 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:53630: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-12 08:06:03 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:12822: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 08:12:23 host2 sshd[1509706]: Disconnected from invalid user user 2.57.121.25 port 10532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.254.134
country_id: 1269750
description:
2025-11-12 08:17:47 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.56.23.125.airtelbroadband.in) [125.20.254.134]:41480: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-12 08:18:03 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:45530: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.31
country_id: 2186224
description:
2025-11-12 08:23:36 dovecot_login authenticator failed for (ADMIN) [179.61.240.31]:13517: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.86
country_id: 2963597
description:
2025-11-12 08:25:17 dovecot_login authenticator failed for (ADMIN) [155.2.194.86]:52195: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Nov 12 08:27:50 host2 sshd[1518309]: Disconnected from invalid user admin 51.75.253.68 port 36722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-12 08:29:46 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:56664: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Nov 12 08:30:06 host2 sshd[1519722]: Disconnected from invalid user tomas 51.75.253.68 port 56556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.165
country_id: 1819730
description:
Nov 12 08:30:27 host2 sshd[1519884]: Disconnected from invalid user a 165.154.244.165 port 44838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.253.68
country_id: 3017382
description:
Nov 12 08:31:10 host2 sshd[1520218]: Disconnected from invalid user kali 51.75.253.68 port 34040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 08:31:31 host2 sshd[1520344]: Disconnected from invalid user admin 2.57.121.112 port 27595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Nov 12 08:32:20 host2 sshd[1520839]: Disconnected from invalid user azuracast 51.75.253.68 port 50194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.165
country_id: 1819730
description:
Nov 12 08:33:08 host2 sshd[1521202]: Disconnected from invalid user kali 165.154.244.165 port 47424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 12 08:33:58 host2 sshd[1521477]: Disconnected from invalid user azuracast 36.67.70.198 port 56228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.253.68
country_id: 3017382
description:
Nov 12 08:34:48 host2 sshd[1521800]: Disconnected from invalid user user 51.75.253.68 port 45484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 12 08:38:44 host2 sshd[1524211]: Disconnected from invalid user ubuntu 36.67.70.198 port 40782 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.199.85.230
country_id: 6252001
description:
[2025-11-12 08:39:50 +0530] info [cpaneld] 134.199.85.230 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.165
country_id: 1819730
description:
Nov 12 08:41:59 host2 sshd[1525967]: Disconnected from invalid user us 165.154.244.165 port 54578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-12 08:42:00 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:8575: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 12 08:41:56 host2 sshd[1525929]: Disconnected from invalid user testuser 36.67.70.198 port 47556 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Nov 12 08:43:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XDk4JV1D8daTuYRV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 12 08:43:30 host2 sshd[1526831]: Disconnected from invalid user user 36.67.70.198 port 50876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Nov 12 08:44:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.92, TLS: Connection closed, session=<KD7OKV1D3LxHBobq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.13
country_id: 390903
description:
2025-11-12 08:47:59 dovecot_login authenticator failed for (ADMIN) [79.127.181.13]:59746: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.35.172.122
country_id: 2635167
description:
[2025-11-12 08:49:55 +0530] info [cpaneld] 161.35.172.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-12 08:54:17 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:52606: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-12 08:56:17 dovecot_plain authenticator failed for (noneve) [154.144.243.93]:46152: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov 12 08:58:30 host2 pure-ftpd[1537228]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-11-12 09:07:01 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:48560: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-12 09:06:27 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:54982: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 09:07:39 host2 sshd[1542589]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-12 09:08:28 dovecot_plain authenticator failed for (onosomind) [65.20.186.177]:35312: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 09:09:52 host2 sshd[1543483]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-11-12 09:10:31 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (obery) [24.98.45.238]:43394: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.102
country_id: 953987
description:
Nov 12 09:13:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.39.102, lip=66.85.158.91, TLS, session=<hVkJkF1D6upmQCdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.2
country_id: 390903
description:
2025-11-12 09:20:48 dovecot_login authenticator failed for (ADMIN) [79.127.181.2]:36777: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 09:25:53 host2 sshd[1553690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.11.182.4
country_id: 2635167
description:
Nov 12 09:32:47 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.11.182.4, lip=66.85.158.91, session=<D1Ze1l1DXItVC7YE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.171.173
country_id: 6252001
description:
Nov 12 09:34:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.171.173, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8iBA3F1DhrIofKut>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Nov 12 09:36:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UFME4l1DFtPG6xh2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.39.81.32
country_id: 6252001
description:
2025-11-12 09:35:33 dovecot_plain authenticator failed for c-98-39-81-32.hsd1.tx.comcast.net (tonpitiang) [98.39.81.32]:38836: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.38
country_id: 2802361
description:
2025-11-12 09:39:36 dovecot_login authenticator failed for (ADMIN) [181.214.218.38]:2213: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Nov 12 09:43:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.43.33.218, lip=66.85.158.91, session=<qTd4+11DVeQtKyHa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.43.33.218
country_id: 1819730
description:
Nov 12 09:43:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=45.43.33.218, lip=66.85.158.91, session=<Je0f/F1DRbwtKyHa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.42.92.153
country_id: 6252001
description:
Nov 12 09:50:05 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.42.92.153, lip=66.85.158.92, TLS handshaking: Connection closed, session=<teY0FF5DPpsUKlyZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-11-12 09:52:29 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:32960: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-12 09:52:44 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:34714: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.19
country_id: 2510769
description:
Nov 12 09:55:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.74.243.19, lip=66.85.158.91, TLS, session=<I0FwJl5Dedm5SvMT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.168
country_id: 3175395
description:
Nov 12 09:55:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.168, lip=66.85.158.91, TLS, session=<bTt8J15DEMK5xQmo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Nov 12 09:56:25 host2 sshd[1571615]: Disconnected from invalid user mike 35.188.112.111 port 37582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Nov 12 09:57:31 host2 sshd[1572319]: Disconnected from invalid user soporte 35.188.112.111 port 60012 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.188.112.111
country_id: 6252001
description:
Nov 12 09:58:35 host2 sshd[1572862]: Disconnected from invalid user tv 35.188.112.111 port 41756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.197.122
country_id: 1880251
description:
Nov 12 09:58:23 host2 sshd[1572720]: Disconnected from invalid user mythtv 143.198.197.122 port 41904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.197.122
country_id: 1880251
description:
Nov 12 09:59:45 host2 sshd[1573415]: Disconnected from invalid user off 143.198.197.122 port 13754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Nov 12 10:00:05 host2 sshd[1573749]: Disconnected from invalid user ftpsecure 103.217.144.113 port 37704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Nov 12 10:00:42 host2 sshd[1574063]: Disconnected from invalid user off 35.188.112.111 port 52346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-12 10:00:48 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:42544: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.102
country_id: 1733045
description:
2025-11-12 10:01:04 dovecot_login authenticator failed for ([49.124.133.102]) [49.124.133.102]:35812: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.197.122
country_id: 1880251
description:
Nov 12 10:01:05 host2 sshd[1574302]: Disconnected from invalid user azureuser 143.198.197.122 port 26548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.65
country_id: 1880251
description:
Nov 12 10:01:50 host2 sshd[1574980]: Disconnected from invalid user user06 45.78.203.65 port 53614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.51
country_id: 1880251
description:
2025-11-12 10:01:52 dovecot_login authenticator failed for (ADMIN) [156.146.57.51]:31864: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.136
country_id: 6252001
description:
Nov 12 10:01:59 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=66.228.53.136, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Uq7HPl5DXvxC5DWI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-12 10:01:20 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:39994: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-12 10:01:38 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:56799: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Nov 12 10:03:39 host2 sshd[1576059]: Disconnected from invalid user joy 211.24.41.44 port 39544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.149
country_id: 1694008
description:
2025-11-12 10:05:09 dovecot_login authenticator failed for ([124.105.219.170]) [124.105.218.149]:59900: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.77.220.188
country_id: 203312
description:
Nov 12 10:04:23 host2 sshd[1576450]: Disconnected from invalid user admin1 41.77.220.188 port 42210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-12 10:05:17 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51038: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.65
country_id: 6252001
description:
2025-11-12 10:07:13 dovecot_login authenticator failed for (ADMIN) [91.124.17.65]:35094: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.113
country_id: 1643084
description:
Nov 12 10:08:05 host2 sshd[1578629]: Disconnected from invalid user andrey 103.217.144.113 port 55634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.48.201.185
country_id: 6252001
description:
Nov 12 10:08:14 host2 sshd[1578695]: Disconnected from invalid user user1 69.48.201.185 port 33824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.48.201.185
country_id: 6252001
description:
Nov 12 10:09:34 host2 sshd[1579243]: Disconnected from invalid user janusz 69.48.201.185 port 47600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.197.122
country_id: 1880251
description:
Nov 12 10:09:38 host2 sshd[1579262]: Disconnected from invalid user dev 143.198.197.122 port 36198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Nov 12 10:09:16 host2 sshd[1579142]: Disconnected from invalid user ajarami 211.24.41.44 port 51044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.48.201.185
country_id: 6252001
description:
Nov 12 10:10:57 host2 sshd[1580276]: Disconnected from invalid user ubuntu 69.48.201.185 port 40988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.77.220.188
country_id: 203312
description:
Nov 12 10:12:48 host2 sshd[1581097]: Disconnected from invalid user tv 41.77.220.188 port 56684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-11-12 10:13:05 dovecot_plain authenticator failed for (piderive) [185.214.169.10]:42694: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.24.41.44
country_id: 1733045
description:
Nov 12 10:17:08 host2 sshd[1583965]: Disconnected from invalid user deluge 211.24.41.44 port 46416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-12 10:17:40 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:60012: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.77.220.188
country_id: 203312
description:
Nov 12 10:17:47 host2 sshd[1584265]: Disconnected from invalid user user06 41.77.220.188 port 42730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 12 10:19:55 host2 sshd[1585587]: Disconnected from invalid user frappe 198.46.207.98 port 36976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.43
country_id: 798549
description:
2025-11-12 10:22:12 dovecot_login authenticator failed for (ADMIN) [143.244.52.43]:20254: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 12 10:22:31 host2 sshd[1587161]: Disconnected from invalid user ftpuser 200.7.101.139 port 33620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Nov 12 10:22:48 host2 sshd[1587275]: Disconnected from invalid user erfan 156.54.170.192 port 51210 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.100
country_id: 6252001
description:
Nov 12 10:23:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.100, lip=66.85.158.91, session=<DMlwjF5D5P7G6xhk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 12 10:23:50 host2 sshd[1587763]: Disconnected from invalid user testadmin 198.46.207.98 port 57572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-11-12 10:24:11 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:45294: 535 Incorrect authentication data (set_id=press@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-11-12 10:23:16 dovecot_login authenticator failed for ([59.145.114.82]) [128.185.219.2]:35032: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-12 10:23:37 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:59623: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.214.4
country_id: 798544
description:
Nov 12 10:25:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.246.214.4, lip=66.85.158.91, TLS, session=<tjM0kF5DW4Zb9tYE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Nov 12 10:25:12 host2 sshd[1588611]: Disconnected from invalid user musicbot 156.54.170.192 port 54563 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-12 10:24:14 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:55858: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.160.53
country_id: 290557
description:
2025-11-12 10:24:25 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:60761: 535 Incorrect authentication data (set_id=press)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 12 10:25:00 host2 sshd[1588258]: Disconnected from invalid user nikita 198.46.207.98 port 56424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 12 10:26:05 host2 sshd[1589067]: Disconnected from invalid user musicbot 198.46.207.98 port 59568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.161.85
country_id: 3469034
description:
Nov 12 10:25:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.161.85, lip=66.85.158.91, TLS, session=<+Y1bkV5DlKCxLKFV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 12 10:27:17 host2 sshd[1589706]: Disconnected from invalid user webuser 198.46.207.98 port 44360 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.29
country_id: 6252001
description:
Nov 12 10:28:53 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.29, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<63wCn15D9s6i2JYd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.29
country_id: 6252001
description:
Nov 12 10:29:20 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.29, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<N62coF5DPPqi2JYd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 10:31:20 host2 sshd[1592245]: Disconnected from invalid user user 2.57.121.25 port 24731 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.170.192
country_id: 3175395
description:
Nov 12 10:33:08 host2 sshd[1593122]: Disconnected from invalid user sysadm 156.54.170.192 port 36399 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.239.84.66
country_id: 2635167
description:
2025-11-12 10:32:56 dovecot_login authenticator failed for (ADMIN) [193.239.84.66]:6347: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.165.200
country_id: 6252001
description:
Nov 12 10:35:32 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.92, session=<egjJtl5DcIVHBqXI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.29
country_id: 6252001
description:
Nov 12 10:36:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.29, lip=66.85.158.92, TLS, session=<FM92uF5DmvKi2JYd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 12 10:35:20 host2 sshd[1594266]: Disconnected from invalid user josh 200.7.101.139 port 47868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.165.200
country_id: 6252001
description:
Nov 12 10:35:33 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.92, session=<1k/Ntl5DCodHBqXI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-12 10:36:50 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 12 10:38:35 host2 sshd[1595838]: Disconnected from invalid user vod 200.7.101.139 port 46782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-12 10:39:49 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:60910: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.145.127
country_id: 690791
description:
Nov 12 10:39:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=37.221.145.127, lip=66.85.158.91, TLS, session=<pqwMxV5Dd5Ml3ZF/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-12 10:40:06 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:40196: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.2.62
country_id: 953987
description:
Nov 12 10:40:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.66.2.62, lip=66.85.158.91, TLS, session=<2TMqxl5D1KZmQgI+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 10:40:14 host2 sshd[1596819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.29
country_id: 718075
description:
2025-11-12 10:45:13 dovecot_login authenticator failed for (ADMIN) [185.225.31.29]:1766: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.37
country_id: 1819730
description:
Nov 12 10:45:55 host2 pure-ftpd[1600627]: (?@45.142.154.37) [INFO] New connection from 45.142.154.37


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.49
country_id: 3469034
description:
Nov 12 10:55:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.168.49, lip=66.85.158.91, TLS, session=<f+iy+15DNYSxgqgx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.208
country_id: 3469034
description:
Nov 12 10:54:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=190.89.136.208, lip=66.85.158.91, TLS, session=<vRp4+l5DZqa+WYjQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 10:58:38 host2 sshd[1607940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.128.234.37
country_id: 3017382
description:
2025-11-12 10:59:30 dovecot_login authenticator failed for 37.234.128.77.rev.sfr.net [77.128.234.37]:39668: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-12 11:00:03 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:37940: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-12 11:00:25 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 12 11:00:24 host2 sshd[1609127]: Invalid user cloudtourssrilan_travel from 182.8.225.116 port 65365


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-12 11:00:29 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:58984: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 12 11:00:22 host2 pure-ftpd[1609121]: (?@182.8.225.116) [INFO] New connection from 182.8.225.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.5
country_id: 2963597
description:
2025-11-12 11:01:15 dovecot_login authenticator failed for (ADMIN) [155.2.194.5]:21690: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 11:03:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52576: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.110
country_id: 6252001
description:
Nov 12 11:03:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.110, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6V05Gl9DxI0tT89u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Nov 12 11:03:27 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.91, TLS, session=<WzqVGl9DVqBC5DUE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 11:03:30 host2 sshd[1611267]: Disconnected from invalid user admin 2.57.121.112 port 64285 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.236
country_id: 3996063
description:
2025-11-12 11:06:00 dovecot_login authenticator failed for (ADMIN) [77.81.142.236]:22922: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-12 11:06:13 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:56146: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-12 11:07:05 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:46240: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-12 11:13:31 dovecot_login authenticator failed for ([128.185.215.38]) [128.185.215.38]:38412: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 12 11:15:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PyewRF9D2KnUZija>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.216.31
country_id: 1880251
description:
[2025-11-12 11:16:14 +0530] info [cpaneld] 152.42.216.31 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-12 11:16:18 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:58595: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.212
country_id: 1269750
description:
Nov 12 11:18:28 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.213.195.212, lip=66.85.158.91, TLS, session=<ctEiT19DRdpn1cPU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.137.157.171
country_id: 3469034
description:
Nov 12 11:18:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.137.157.171, lip=66.85.158.91, TLS, session=<Ce9nUF9DY5uxiZ2r>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.96.201
country_id: 1605651
description:
2025-11-12 11:20:43 dovecot_login authenticator failed for node-j49.pool-182-53.dynamic.nt-isp.net (UJwmRrT) [182.53.96.201]:54656: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.36.35.134
country_id: 1643084
description:
2025-11-12 11:20:42 dovecot_login authenticator failed for (gUeNQOu) [103.36.35.134]:36393: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.167.160
country_id: 99237
description:
Nov 12 11:23:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=65.20.167.160, lip=66.85.158.91, TLS, session=<1/XjYF9DSbZBFKeg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.196.125.164
country_id: 3175395
description:
Nov 12 11:23:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=62.196.125.164, lip=66.85.158.91, TLS, session=<i9UGYl9DNtc+xH2k>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.207.179
country_id: 6252001
description:
Nov 12 11:26:08 host2 pure-ftpd[1624812]: (?@152.32.207.179) [INFO] New connection from 152.32.207.179


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.94
country_id: 2635167
description:
Nov 12 11:27:06 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.94, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dG8xb19D/cgjy9Ne>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.219.229.99
country_id: 6252001
description:
2025-11-12 11:26:13 dovecot_login authenticator failed for (67-219-229-99.mycomspan.com) [67.219.229.99]:40590: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-11-12 11:26:17 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:34242: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.11.128
country_id: 6252001
description:
2025-11-12 11:26:32 dovecot_login authenticator failed for 160-3-11-128.cpe.sparklight.net [160.3.11.128]:33680: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-11-12 11:26:37 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:57549: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.7
country_id: 6251999
description:
2025-11-12 11:27:30 dovecot_login authenticator failed for (ADMIN) [89.149.52.7]:22784: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.94
country_id: 2635167
description:
Nov 12 11:28:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.94, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VsQbc19DOO8jy9Ne>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.94
country_id: 2635167
description:
Nov 12 11:28:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.94, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<j8kxc19DRu8jy9Ne>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 11:32:22 host2 sshd[1628638]: Disconnected from invalid user admin 2.57.121.112 port 18127 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.94
country_id: 2635167
description:
Nov 12 11:33:27 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.94, lip=66.85.158.91, TLS, session=<Mp/ihV9DfOAjy9Ne>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.94
country_id: 2635167
description:
Nov 12 11:34:59 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.94, lip=66.85.158.91, TLS, session=<6tNbi19DkuAjy9Ne>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-11-12 11:42:39 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:42338: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.210
country_id: 6252001
description:
Nov 12 11:42:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.210, lip=66.85.158.92, TLS, session=<PxKrpl9DgvSTuYTS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-12 11:46:50 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:58772: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.211.101
country_id: 1819730
description:
2025-11-12 11:49:19 dovecot_login authenticator failed for (host-by.00.net) [103.77.211.101]:48585: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.193
country_id: 6252001
description:
Nov 12 11:54:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.193, lip=66.85.158.92, session=<nxfwz19DBObG6xjB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-12 11:55:28 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:41622: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
country_id: 6252001
description:
2025-11-12 11:55:45 dovecot_login authenticator failed for ([50.79.249.83]) [50.79.249.83]:32971: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.162
country_id: 6252001
description:
Nov 12 12:02:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.162, lip=66.85.158.91, TLS, session=<Avwc7V9DUvvN0h+i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.127
country_id: 2960313
description:
2025-11-12 12:03:12 dovecot_login authenticator failed for (ADMIN) [37.46.113.127]:31001: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Nov 12 12:03:51 host2 pure-ftpd[1648195]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.67.28.239
country_id: 1643084
description:
2025-11-12 12:06:02 dovecot_login authenticator failed for ([36.67.28.239]) [36.67.28.239]:1362: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-12 12:06:21 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:60019: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-11-12 12:11:03 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:46640: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-12 12:11:28 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:50676: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 12:13:14 host2 sshd[1654621]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-12 12:15:26 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:38280: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-12 12:15:36 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:57251: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.114.240
country_id: 6252001
description:
2025-11-12 12:15:45 dovecot_plain authenticator failed for ([104.234.114.240]) [104.234.114.240]:49791: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 12:19:13 host2 sshd[1659276]: Disconnected from invalid user admin 2.57.121.112 port 35112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.21
country_id: 2750405
description:
2025-11-12 12:25:03 dovecot_login authenticator failed for (ADMIN) [158.173.3.21]:7563: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.112.12
country_id: 1819730
description:
Nov 12 12:25:37 host2 sshd[1662962]: Disconnected from invalid user ansible 165.154.112.12 port 47636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-12 12:30:20 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:49402: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-12 12:30:32 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:40866: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 12:31:41 host2 sshd[1666239]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.59
country_id: 6252001
description:
2025-11-12 12:32:56 dovecot_login authenticator failed for (ADMIN) [95.181.238.59]:56262: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.112.12
country_id: 1819730
description:
Nov 12 12:35:09 host2 sshd[1668242]: Disconnected from invalid user artem 165.154.112.12 port 43834 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.112.12
country_id: 1819730
description:
Nov 12 12:36:33 host2 sshd[1668919]: Disconnected from invalid user sshuser 165.154.112.12 port 43284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.112.12
country_id: 1819730
description:
Nov 12 12:37:59 host2 sshd[1669617]: Disconnected from invalid user min 165.154.112.12 port 48860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.112.12
country_id: 1819730
description:
Nov 12 12:40:43 host2 sshd[1671139]: Disconnected from invalid user mcadmin 165.154.112.12 port 38052 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov 12 12:49:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, TLS, session=<IkVtlmBD9OHG6xhS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.76
country_id: 2186224
description:
2025-11-12 12:53:05 dovecot_login authenticator failed for (ADMIN) [179.61.240.76]:57509: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 12:53:13 host2 sshd[1678506]: Disconnected from invalid user asha 62.60.131.157 port 10186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.80.207
country_id: 241170
description:
2025-11-12 12:57:11 dovecot_login authenticator failed for (nf1WQL) [196.251.80.207]:64094: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.80.207
country_id: 241170
description:
2025-11-12 12:57:34 dovecot_login authenticator failed for (8d3PnoCgLC) [196.251.80.207]:55818: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.251.80.207
country_id: 241170
description:
2025-11-12 12:58:20 dovecot_login authenticator failed for (ig1HxhR) [196.251.80.207]:50071: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 12 13:00:50 host2 sshd[1683547]: Disconnected from invalid user ankit 154.83.15.123 port 38874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.171
country_id: 2635167
description:
2025-11-12 13:04:06 dovecot_login authenticator failed for (ADMIN) [158.173.23.171]:53050: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 12 13:04:16 host2 sshd[1685934]: Disconnected from invalid user fs 154.83.15.123 port 44168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2025-11-12 13:05:13 dovecot_login authenticator failed for ([61.2.212.194]) [61.2.212.194]:57521: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.140
country_id: 1880251
description:
Nov 12 13:08:48 host2 sshd[1688266]: Disconnected from invalid user bwa 45.78.220.140 port 43182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov 12 13:08:31 host2 sshd[1688162]: Disconnected from invalid user ftpuser 40.160.2.64 port 33840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov 12 13:12:39 host2 sshd[1690383]: Disconnected from invalid user deploy 40.160.2.64 port 53764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.194.198
country_id: 2077456
description:
2025-11-12 13:13:44 dovecot_login authenticator failed for (ADMIN) [173.239.194.198]:33835: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.98.139
country_id: 1269750
description:
2025-11-12 13:13:53 dovecot_login authenticator failed for (abts-mum-static-139.98.170.122.airtelbroadband.in) [122.170.98.139]:39727: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-11-12 13:14:25 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57297: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-12 13:15:53 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:49804: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-12 13:16:12 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:49564: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-12 13:16:36 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:41956: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.169
country_id: 798544
description:
Nov 12 13:16:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.238.166.169, lip=66.85.158.91, TLS, session=<kSJG9mBDR8Nb7qap>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.123
country_id: 3469034
description:
Nov 12 13:17:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.199.123, lip=66.85.158.91, TLS, session=<jept92BDvL2zvcd7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-12 13:17:21 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:50600: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.85
country_id: 1733045
description:
2025-11-12 13:17:37 dovecot_login authenticator failed for ([49.124.151.85]) [49.124.151.85]:40060: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-12 13:17:54 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:36345: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.160.2.64
country_id: 6252001
description:
Nov 12 13:17:57 host2 sshd[1693515]: Disconnected from invalid user cxy 40.160.2.64 port 41226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-12 13:18:03 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:51695: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov 12 13:20:53 host2 sshd[1695113]: Disconnected from invalid user alex 40.160.2.64 port 58390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.140
country_id: 1880251
description:
Nov 12 13:20:45 host2 sshd[1695020]: Disconnected from invalid user debian 45.78.220.140 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov 12 13:23:40 host2 sshd[1696389]: Disconnected from invalid user bi 40.160.2.64 port 56288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.74
country_id: 783754
description:
2025-11-12 13:29:16 dovecot_login authenticator failed for (ADMIN) [31.171.154.74]:40676: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-12 13:34:03 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:37526: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 13:34:54 host2 sshd[1702940]: Disconnected from invalid user admin 2.57.121.112 port 12141 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.173
country_id: 3041565
description:
2025-11-12 13:37:53 dovecot_login authenticator failed for (ADMIN) [173.239.217.173]:39320: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-12 13:40:28 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:35578: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.217
country_id: 1605651
description:
Nov 12 13:40:59 host2 sshd[1706111]: Disconnected from invalid user mithun 49.49.243.217 port 46762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-12 13:41:10 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:48142: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.217
country_id: 1605651
description:
Nov 12 13:45:55 host2 sshd[1709799]: Disconnected from invalid user testuser 49.49.243.217 port 49048 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 13:46:16 host2 sshd[1710018]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.49.243.217
country_id: 1605651
description:
Nov 12 13:47:32 host2 sshd[1710565]: Disconnected from invalid user compras 49.49.243.217 port 53188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.234.36.180
country_id: 3686110
description:
Nov 12 13:49:15 host2 sshd[1711571]: Disconnected from invalid user john 181.234.36.180 port 39308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.240.244.53
country_id: 1269750
description:
2025-11-12 13:49:29 dovecot_login authenticator failed for ([115.240.244.52]) [115.240.244.53]:10400: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-12 13:49:43 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:49578: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.123.110
country_id: 2921044
description:
Nov 12 13:50:43 host2 pure-ftpd[1712372]: (?@64.227.123.110) [INFO] New connection from 64.227.123.110


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.180.237
country_id: 2921044
description:
Nov 12 13:50:55 host2 pure-ftpd[1712472]: (?@167.172.180.237) [INFO] New connection from 167.172.180.237


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 139.59.215.207
country_id: 2921044
description:
Nov 12 13:50:55 host2 pure-ftpd[1712476]: (?@139.59.215.207) [INFO] New connection from 139.59.215.207


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 167.172.180.237
country_id: 2921044
description:
Nov 12 13:51:00 host2 pure-ftpd[1712507]: (?@167.172.180.237) [INFO] New connection from 167.172.180.237


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.217
country_id: 1605651
description:
Nov 12 13:51:49 host2 sshd[1712908]: Disconnected from invalid user jessica 49.49.243.217 port 37340 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.234.36.180
country_id: 3686110
description:
Nov 12 13:54:09 host2 sshd[1714424]: Disconnected from invalid user jan 181.234.36.180 port 50352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.217
country_id: 1605651
description:
Nov 12 13:55:00 host2 sshd[1715125]: Disconnected from invalid user nitin 49.49.243.217 port 45620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-12 13:57:46 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:32908: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 12 13:58:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.161.174.170, lip=66.85.158.91, session=<bZXCi2FDgrozoa6q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.56
country_id: 2635167
description:
2025-11-12 13:58:30 dovecot_login authenticator failed for (ADMIN) [98.159.234.56]:35951: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-12 14:01:03 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:56665: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.146
country_id: 1733045
description:
2025-11-12 14:01:33 dovecot_login authenticator failed for ([49.124.152.146]) [49.124.152.146]:44798: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 14:03:43 host2 sshd[1720530]: Disconnected from invalid user admin 2.57.121.112 port 40962 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 14:04:37 host2 sshd[1721013]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-11-12 14:06:12 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:45680: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2025-11-12 14:06:49 dovecot_login authenticator failed for (nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:52717: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-12 14:07:05 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:58828: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.193.106.227
country_id: 357994
description:
Nov 12 14:07:14 host2 sshd[1722428]: Disconnected from invalid user victor 62.193.106.227 port 56546 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.193.106.227
country_id: 357994
description:
Nov 12 14:08:31 host2 sshd[1723004]: Disconnected from invalid user test 62.193.106.227 port 59940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.193.106.227
country_id: 357994
description:
Nov 12 14:09:53 host2 sshd[1723733]: Disconnected from invalid user jack 62.193.106.227 port 35108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.193.106.227
country_id: 357994
description:
Nov 12 14:11:24 host2 sshd[1724572]: Disconnected from invalid user deploy 62.193.106.227 port 38514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-11-12 14:14:45 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:49992: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-11-12 14:15:02 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:48342: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.76
country_id: 6251999
description:
2025-11-12 14:17:54 dovecot_login authenticator failed for (ADMIN) [89.149.52.76]:54288: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.104
country_id: 6252001
description:
2025-11-12 14:23:03 dovecot_login authenticator failed for (ADMIN) [158.173.153.104]:24858: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.21.39.206
country_id: 798544
description:
Nov 12 14:23:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.21.39.206, lip=66.85.158.91, TLS, session=<SjVs42FDbu25FSfO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.101.163
country_id: 3996063
description:
Nov 12 14:23:20 host2 sshd[1732090]: Disconnected from invalid user celery 189.178.101.163 port 38350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.81
country_id: 3865483
description:
Nov 12 14:23:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=200.229.252.81, lip=66.85.158.91, TLS, session=<Pn2P5GFDB4jI5fxR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.239
country_id: 3469034
description:
Nov 12 14:23:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=187.120.73.239, lip=66.85.158.91, TLS, session=<Yjyz5WFDPd27eEnv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.207
country_id: 953987
description:
Nov 12 14:24:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.79.19.207, lip=66.85.158.91, TLS, session=<iwr65mFDVeMpTxPP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 14:27:00 host2 sshd[1733866]: Disconnected from invalid user dayana 62.60.131.157 port 64612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.101.163
country_id: 3996063
description:
Nov 12 14:27:13 host2 sshd[1734021]: Disconnected from invalid user vmail 189.178.101.163 port 38436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.101.163
country_id: 3996063
description:
Nov 12 14:28:30 host2 sshd[1734702]: Disconnected from invalid user jenkins 189.178.101.163 port 38570 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 14:37:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61652: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.196
country_id: 1733045
description:
2025-11-12 14:37:16 dovecot_login authenticator failed for ([49.124.159.196]) [49.124.159.196]:33004: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-12 14:37:45 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:41490: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.37
country_id: 6252001
description:
Nov 12 14:42:48 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kbgQK2JDs8DN0h8l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-11-12 14:46:48 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:46670: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.186
country_id: 2623032
description:
2025-11-12 14:49:34 dovecot_login authenticator failed for (ADMIN) [188.126.94.186]:9209: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 15:02:41 host2 sshd[1755557]: Disconnected from invalid user nikita 62.60.131.157 port 51447 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.246.252
country_id: 2802361
description:
Nov 12 15:04:14 host2 pure-ftpd[1756977]: (?@34.38.246.252) [INFO] New connection from 34.38.246.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.17.49
country_id: 3175395
description:
Nov 12 15:04:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.43.17.49, lip=66.85.158.91, TLS, session=<ZwK9dmJD0Zq5KxEx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.132.193
country_id: 3469034
description:
Nov 12 15:04:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=191.53.132.193, lip=66.85.158.91, TLS, session=<6PXcd2JDqry/NYTB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-12 15:05:00 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.116.165]:45976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 12 15:05:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<U1m4e2JDCP/CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2025-11-12 15:05:37 dovecot_login authenticator failed for ([49.125.201.68]) [49.125.201.68]:40486: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-12 15:05:58 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:38050: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-12 15:06:22 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54494: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.239.84.92
country_id: 2635167
description:
2025-11-12 15:06:58 dovecot_login authenticator failed for (ADMIN) [193.239.84.92]:30650: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.32.62
country_id: 1269750
description:
2025-11-12 15:12:53 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [49.43.32.62]:45578: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.56
country_id: 1733045
description:
2025-11-12 15:13:17 dovecot_login authenticator failed for ([49.124.145.56]) [49.124.145.56]:49600: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 15:18:56 host2 sshd[1766001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 15:18:54 host2 sshd[1765918]: Disconnected from invalid user admin 2.57.121.112 port 58938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-12 15:19:37 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:60754: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-12 15:19:17 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:9435: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-12 15:20:28 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:34157: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-12 15:21:22 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:45082: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov 12 15:26:41 host2 sshd[1770629]: Disconnected from invalid user usman 144.31.194.75 port 60624 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.79
country_id: 2635167
description:
Nov 12 15:27:23 host2 pure-ftpd[1771136]: (?@87.236.176.79) [INFO] New connection from 87.236.176.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.229.33
country_id: 149590
description:
Nov 12 15:28:09 host2 sshd[1771595]: Disconnected from invalid user amir 41.59.229.33 port 34094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov 12 15:28:28 host2 sshd[1771779]: Disconnected from invalid user devops 144.31.194.75 port 58442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.252.34.234
country_id: 2215636
description:
Nov 12 15:29:37 host2 sshd[1772570]: Disconnected from invalid user debian 38.252.34.234 port 33946 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.194.75
country_id: 6252001
description:
Nov 12 15:29:40 host2 sshd[1772604]: Disconnected from invalid user test1 144.31.194.75 port 53762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov 12 15:30:44 host2 sshd[1773264]: Disconnected from invalid user ivan 144.31.194.75 port 43692 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 12 15:31:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<7V532GJDvP/CpRCk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.229.33
country_id: 149590
description:
Nov 12 15:31:32 host2 sshd[1773782]: Disconnected from invalid user jimmy 41.59.229.33 port 45776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov 12 15:33:06 host2 sshd[1774684]: Disconnected from invalid user lisa 144.31.194.75 port 50888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.186
country_id: 2661886
description:
2025-11-12 15:33:16 dovecot_login authenticator failed for (ADMIN) [46.246.3.186]:53003: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.252.34.234
country_id: 2215636
description:
Nov 12 15:34:18 host2 sshd[1775251]: Disconnected from invalid user andi 38.252.34.234 port 50428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.229.33
country_id: 149590
description:
Nov 12 15:35:08 host2 sshd[1775787]: Disconnected from invalid user ms 41.59.229.33 port 55700 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.170
country_id: 6252001
description:
Nov 12 15:37:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.170, lip=66.85.158.92, session=<UVwN7WJD6YHDuEyq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 15:37:13 host2 sshd[1776890]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.65
country_id: 6252001
description:
Nov 12 15:37:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.65, lip=66.85.158.92, session=<+BSo7WJDMdbDuExB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.70
country_id: 6252001
description:
Nov 12 15:37:19 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.70, lip=66.85.158.92, session=<uxwC7mJDJcjDuExG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.66
country_id: 6252001
description:
Nov 12 15:37:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.66, lip=66.85.158.92, session=<1TMy7mJDd9XDuExC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.59.229.33
country_id: 149590
description:
Nov 12 15:38:39 host2 sshd[1777653]: Disconnected from invalid user noreply 41.59.229.33 port 55600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.252.34.234
country_id: 2215636
description:
Nov 12 15:38:56 host2 sshd[1777744]: Disconnected from invalid user boom 38.252.34.234 port 38022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.229.33
country_id: 149590
description:
Nov 12 15:40:28 host2 sshd[1778563]: Disconnected from invalid user usman 41.59.229.33 port 43624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-12 15:43:12 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:44750: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.211.172
country_id: 1522867
description:
2025-11-12 15:43:40 dovecot_login authenticator failed for 178.89.211.172.dynamic.telecom.kz [178.89.211.172]:57621: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-12 15:44:50 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:59576: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-12 15:45:11 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:54024: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-12 15:45:45 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:38140: 535 Incorrect authentication data (set_id=orders@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-12 15:46:15 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:44972: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 12 15:49:52 host2 sshd[1784702]: Disconnected from invalid user str 182.93.50.90 port 41102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 12 15:51:26 host2 sshd[1785726]: Disconnected from invalid user publico 159.65.185.221 port 33754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.116
country_id: 6252001
description:
Nov 12 15:51:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.116, lip=66.85.158.92, TLS, session=<3AVjIWNDPODG6xh0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Nov 12 15:52:44 host2 sshd[1786411]: Disconnected from invalid user radarr 160.202.8.218 port 42080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-12 15:53:57 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:40636: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Nov 12 15:54:52 host2 sshd[1788573]: Disconnected from invalid user ubuntu 160.202.8.218 port 41668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 12 15:55:24 host2 sshd[1789009]: Disconnected from invalid user vpn 159.65.185.221 port 52930 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 12 15:56:32 host2 sshd[1789482]: Disconnected from invalid user radarr 159.65.185.221 port 49160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 12 15:58:43 host2 sshd[1790455]: Disconnected from invalid user ldap 159.65.185.221 port 50340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 12 16:01:09 host2 sshd[1792639]: Disconnected from invalid user wilson 182.93.50.90 port 52086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.32
country_id: 1643084
description:
Nov 12 16:02:16 host2 sshd[1793302]: Disconnected from invalid user webmin 118.99.80.32 port 12911 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 12 16:03:07 host2 sshd[1793848]: Disconnected from invalid user str 159.65.185.221 port 47756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-12 16:04:14 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:37722: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-12 16:04:36 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:23063: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 12 16:04:07 host2 sshd[1794712]: Disconnected from invalid user admin 182.93.50.90 port 52928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-12 16:05:11 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:34212: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.202.8.218
country_id: 1269750
description:
Nov 12 16:06:03 host2 sshd[1795890]: Disconnected from invalid user lol 160.202.8.218 port 55032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 12 16:07:08 host2 sshd[1797202]: Disconnected from invalid user publico 182.93.50.90 port 46996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.41
country_id: 1861060
description:
2025-11-12 16:07:11 dovecot_login authenticator failed for (ADMIN) [149.22.87.41]:24621: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.99.80.32
country_id: 1643084
description:
Nov 12 16:10:39 host2 sshd[1801096]: Disconnected from invalid user admin 118.99.80.32 port 11464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.92
country_id: 3017382
description:
2025-11-12 16:14:43 dovecot_login authenticator failed for (ADMIN) [203.188.183.92]:4977: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-11-12 16:14:40 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:54966: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.12
country_id: 1880251
description:
Nov 12 16:17:00 host2 sshd[1805081]: Disconnected from invalid user usertest 101.47.162.12 port 46652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.12
country_id: 1880251
description:
Nov 12 16:19:31 host2 sshd[1806327]: Disconnected from invalid user deploy 101.47.162.12 port 51790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 12 16:19:48 host2 sshd[1806449]: Disconnected from invalid user git 182.93.50.90 port 44992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.144.36.39
country_id: 1269750
description:
Nov 12 16:20:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@agentallianz.com>, method=PLAIN, rip=103.144.36.39, lip=66.85.158.91, TLS, session=<4SyqhWNDeehnkCQn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.128.57
country_id: 3469034
description:
Nov 12 16:20:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=201.55.128.57, lip=66.85.158.91, TLS, session=<oO7ihmNDK9DJN4A5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.12
country_id: 1880251
description:
Nov 12 16:24:30 host2 sshd[1808805]: Disconnected from invalid user radarr 101.47.162.12 port 40138 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.39
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.39: 250 connections per 30 seconds to 8443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.39
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.39: 454 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-12 16:38:05 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:49629: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-12 16:38:17 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:54892: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-12 16:47:04 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:52993: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-12 16:47:31 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:58142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 16:50:34 host2 sshd[1826325]: Disconnected from invalid user admin 2.57.121.112 port 27686 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 16:51:44 host2 sshd[1827120]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.19.53
country_id: 2921044
description:
2025-11-12 16:56:06 dovecot_login authenticator failed for (ADMIN) [138.199.19.53]:47631: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.213.224.4
country_id: 6252001
description:
2025-11-12 16:57:00 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:54552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-12 16:57:13 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:50344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-12 16:57:37 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:47080: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.118
country_id: 783754
description:
2025-11-12 16:59:47 dovecot_login authenticator failed for (ADMIN) [31.171.154.118]:35752: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.115
country_id: 3017382
description:
Nov 12 17:02:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.115, lip=66.85.158.92, session=<zusaHWRD+ZJbxJhz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.114
country_id: 3017382
description:
Nov 12 17:02:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.114, lip=66.85.158.92, session=<lHK9HWRD6bNbxJhy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.24
country_id: 3017382
description:
Nov 12 17:02:29 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.24, lip=66.85.158.92, session=<OuaZHmRDs+lbxJgY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.29
country_id: 3017382
description:
Nov 12 17:02:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.29, lip=66.85.158.92, session=<TiDMHmRDIaxbxJgd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 12 17:08:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Qpn+MmRDRP7CpRCk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.187
country_id: 1643084
description:
Nov 12 17:09:11 host2 sshd[1837787]: Disconnected from invalid user sharan 103.139.193.187 port 52176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.3
country_id: 1733045
description:
2025-11-12 17:09:28 dovecot_login authenticator failed for ([49.124.148.3]) [49.124.148.3]:59882: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 17:10:10 host2 sshd[1838383]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-12 17:17:40 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:52893: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.187
country_id: 1643084
description:
Nov 12 17:20:09 host2 sshd[1843931]: Disconnected from invalid user app 103.139.193.187 port 47550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-11-12 17:21:39 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:38844: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.96.146.250
country_id: 6252001
description:
2025-11-12 17:21:52 dovecot_login authenticator failed for ([157.96.146.250]) [157.96.146.250]:44028: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.43
country_id: 6252001
description:
2025-11-12 17:26:43 dovecot_login authenticator failed for (ADMIN) [212.32.50.43]:54258: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.116.129.142
country_id: 1880251
description:
Nov 12 17:28:25 host2 sshd[1848614]: Disconnected from invalid user etienne 203.116.129.142 port 34762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-12 17:32:42 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:58156: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-12 17:33:02 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:59034: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 12 17:33:52 host2 sshd[1852803]: Disconnected from invalid user sonu 52.237.80.79 port 49850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 12 17:34:02 host2 sshd[1852971]: Disconnected from invalid user ubuntu 123.58.213.52 port 35254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-12 17:34:17 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:49406: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-12 17:34:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:32401: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.116.129.142
country_id: 1880251
description:
Nov 12 17:35:35 host2 sshd[1854556]: Disconnected from invalid user ubuntu 203.116.129.142 port 31520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-12 17:35:14 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:44451: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 17:35:25 host2 sshd[1854249]: Disconnected from invalid user guadalupe 62.60.131.157 port 29048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-12 17:35:30 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:43470: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 12 17:36:43 host2 sshd[1855398]: Disconnected from invalid user test1 190.129.122.12 port 33507 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 12 17:36:34 host2 sshd[1855285]: Disconnected from invalid user newftpuser 123.58.213.52 port 35110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 12 17:37:45 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<Rni3nGRDef7CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-11-12 17:38:08 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:37542: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-12 17:38:11 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:56040: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-12 17:38:21 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:34711: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-11-12 17:38:35 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:42670: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 12 17:38:48 host2 sshd[1856956]: Disconnected from invalid user sonu 103.249.84.18 port 58292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.116.129.142
country_id: 1880251
description:
Nov 12 17:39:36 host2 sshd[1857382]: Disconnected from invalid user user 203.116.129.142 port 42456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 12 17:41:04 host2 sshd[1858554]: Disconnected from invalid user ftpuser 190.129.122.12 port 1179 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.116.129.142
country_id: 1880251
description:
Nov 12 17:41:00 host2 sshd[1858488]: Disconnected from invalid user baba 203.116.129.142 port 21792 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.88
country_id: 6252001
description:
Nov 12 17:42:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.155.88, lip=66.85.158.92, TLS: Connection closed, session=<+5wFrGRDXP3HLZtY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 12 17:42:03 host2 sshd[1859295]: Disconnected from invalid user caja01 103.249.84.18 port 45724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 12 17:43:38 host2 sshd[1860139]: Disconnected from invalid user ubuntu 52.237.80.79 port 44926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Nov 12 17:44:12 host2 sshd[1860697]: Disconnected from invalid user mpi 123.58.213.52 port 39354 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 12 17:45:11 host2 sshd[1861592]: Disconnected from invalid user sri 103.249.84.18 port 44254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Nov 12 17:45:39 host2 sshd[1861858]: Disconnected from invalid user db2inst1 190.129.122.12 port 49770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.235.177
country_id: 1861060
description:
Nov 12 17:46:48 host2 sshd[1862907]: Disconnected from invalid user mostafa 43.167.235.177 port 44660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Nov 12 17:46:46 host2 sshd[1862872]: Disconnected from invalid user baba 103.249.84.18 port 59932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 12 17:47:27 host2 sshd[1863495]: Disconnected from invalid user rsyncuser 202.165.16.9 port 51166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 12 17:47:46 host2 sshd[1863770]: Disconnected from invalid user caja01 52.237.80.79 port 33460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.90
country_id: 2077456
description:
2025-11-12 17:49:36 dovecot_login authenticator failed for (ADMIN) [154.16.81.90]:32792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.26
country_id: 1880251
description:
Nov 12 17:50:58 host2 sshd[1866346]: Disconnected from invalid user alex 45.78.205.26 port 56010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 12 17:51:55 host2 sshd[1866876]: Disconnected from invalid user cs 52.237.80.79 port 41196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 12 17:52:13 host2 sshd[1867158]: Disconnected from invalid user gabriel 202.165.16.9 port 34684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.235.177
country_id: 1861060
description:
Nov 12 17:52:40 host2 sshd[1867363]: Disconnected from invalid user noah 43.167.235.177 port 57318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 12 17:53:39 host2 sshd[1868266]: Disconnected from invalid user admin 202.165.16.9 port 57258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 12 17:53:18 host2 sshd[1867985]: Disconnected from invalid user user 52.237.80.79 port 59292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 12 17:55:01 host2 sshd[1869935]: Disconnected from invalid user iqbal 202.165.16.9 port 49708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.235.177
country_id: 1861060
description:
Nov 12 17:54:15 host2 sshd[1868834]: Disconnected from invalid user rich 43.167.235.177 port 48048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.11.182.4
country_id: 2635167
description:
Nov 12 17:55:36 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.11.182.4, lip=66.85.158.92, session=<qzeU3GRDLN9VC7YE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.9
country_id: 1733045
description:
Nov 12 17:56:20 host2 sshd[1871303]: Disconnected from invalid user pt 202.165.16.9 port 51346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-11-12 17:58:27 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:37462: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.151.194
country_id: 3469034
description:
2025-11-12 17:58:40 dovecot_login authenticator failed for ([187.6.151.177]) [187.6.151.194]:60049: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-12 18:02:54 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:46273: 535 Incorrect authentication data (set_id=team@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.157.32
country_id: 337996
description:
2025-11-12 18:03:30 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1726: 535 Incorrect authentication data (set_id=team)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 18:05:55 host2 sshd[1878684]: Disconnected from invalid user user 2.57.121.25 port 19556 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 12 18:16:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.91, TLS: Connection closed, session=<CDvGJWVD3NqUcdZj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 12 18:16:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jgs9JmVDtraUcdZj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-12 18:17:31 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:41516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-12 18:18:05 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:48246: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-12 18:18:07 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:48512: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-12 18:18:19 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:41242: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.73
country_id: 2623032
description:
2025-11-12 18:19:30 dovecot_login authenticator failed for (ADMIN) [188.126.94.73]:47400: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2025-11-12 18:20:07 dovecot_login authenticator failed for ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:44804: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-11-12 18:22:57 dovecot_login authenticator failed for (dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:49662: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 18:25:16 host2 sshd[1892284]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.26
country_id: 1880251
description:
Nov 12 18:26:08 host2 sshd[1892624]: Disconnected from invalid user http 45.78.205.26 port 47490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 18:27:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50917: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-12 18:33:29 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:56756: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-12 18:33:43 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:57243: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-12 18:34:46 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (paphyph) [73.129.57.71]:49098: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.122.151
country_id: 3042058
description:
Nov 12 18:38:52 host2 pure-ftpd[1900649]: (?@91.90.122.151) [INFO] New connection from 91.90.122.151


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.39.168
country_id: 1861060
description:
Nov 12 18:38:53 host2 pure-ftpd[1900655]: (?@138.199.39.168) [INFO] New connection from 138.199.39.168


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 18:42:30 host2 sshd[1903080]: Disconnected from invalid user user 2.57.121.25 port 9217 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 18:43:55 host2 sshd[1904184]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:44:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<2INPi2VDILYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:46:04 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<2uUKkWVDuL8Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.100
country_id: 6252001
description:
2025-11-12 18:47:00 dovecot_login authenticator failed for (ADMIN) [95.181.238.100]:53784: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:46:06 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<LMQkkWVDbrADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:47:29 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=</REelmVDKsIDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-12 18:47:42 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:32862: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:48:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Jx69mGVDsIYDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:48:43 host2 dovecot[43647]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eaR/mmVDoOgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:49:09 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<KE4XnGVDJuUDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.77
country_id: 2635167
description:
2025-11-12 18:50:17 dovecot_login authenticator failed for (ADMIN) [98.159.234.77]:40139: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:50:21 host2 dovecot[43647]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<Pq5doGVDzOoDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 12 18:51:29 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<jctkpGVDlK0Dg9cm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 12 18:56:37 host2 pure-ftpd[1912717]: (?@148.113.213.23) [INFO] New connection from 148.113.213.23


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 12 18:56:40 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, TLS, session=<adn2tmVDmLmUcdUX>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 12 18:56:43 host2 pure-ftpd[1912759]: (?@148.113.213.23) [INFO] New connection from 148.113.213.23


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-12 18:58:59 dovecot_plain authenticator failed for (vamus) [103.51.26.198]:42343: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 19:09:57 host2 sshd[1920715]: Disconnected from invalid user winston 62.60.131.157 port 19930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-11-12 19:13:09 dovecot_login authenticator failed for (m121-202-152-6.smartone.com) [121.202.152.6]:44528: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-12 19:15:04 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:33740: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-12 19:14:34 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:61365: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 12 19:14:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, TLS: Connection closed, session=<pNbV92VDfqJo7NEL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.42
country_id: 3625428
description:
2025-11-12 19:15:48 dovecot_login authenticator failed for (ADMIN) [95.181.237.42]:43312: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-12 19:15:24 dovecot_login authenticator failed for ([152.52.169.97]) [122.186.60.142]:43786: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.7.228.60
country_id: 3895114
description:
Nov 12 19:22:17 host2 sshd[1928856]: Disconnected from invalid user andrey 45.7.228.60 port 45254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.7.228.60
country_id: 3895114
description:
Nov 12 19:26:08 host2 sshd[1931409]: Disconnected from invalid user admin 45.7.228.60 port 53806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.74.228
country_id: 1880251
description:
Nov 12 19:26:59 host2 sshd[1931902]: Disconnected from invalid user erpuser 194.233.74.228 port 48664 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.114.175.11
country_id: 2510769
description:
Nov 12 19:29:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=185.114.175.11, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1KgzLWZDf+i5cq8L>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.7.228.60
country_id: 3895114
description:
Nov 12 19:30:28 host2 sshd[1934470]: Disconnected from invalid user ubuntu 45.7.228.60 port 41944 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-12 19:31:16 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:59562: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.7.228.60
country_id: 3895114
description:
Nov 12 19:31:50 host2 sshd[1935277]: Disconnected from invalid user user 45.7.228.60 port 36952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.42
country_id: 3703430
description:
2025-11-12 19:40:47 dovecot_login authenticator failed for (ADMIN) [91.90.126.42]:54738: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-12 19:51:24 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:51970: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-12 19:51:10 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:52928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 19:59:03 host2 sshd[1951966]: Disconnected from invalid user admin 2.57.121.112 port 61203 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 19:59:14 host2 sshd[1952108]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-12 20:04:44 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:51142: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.84.237.158
country_id: 3469034
description:
2025-11-12 20:05:16 dovecot_login authenticator failed for 177-84-237-158.allrede.tec.br [177.84.237.158]:34002: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-12 20:05:34 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:40458: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.217
country_id: 6252001
description:
2025-11-12 20:06:48 dovecot_login authenticator failed for (ADMIN) [212.32.49.217]:62762: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.29
country_id: 2017370
description:
Nov 12 20:07:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=178.22.24.29, lip=66.85.158.91, session=<vkjys2ZDLfuyFhgd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 12 20:07:52 host2 sshd[1957658]: Disconnected from invalid user upload 152.32.218.244 port 38808 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.129
country_id: 2635167
description:
Nov 12 20:08:36 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.129, lip=66.85.158.92, TLS, session=<FUA2uGZDN4m594mB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Nov 12 20:08:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+YtDuGZDl6W594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 12 20:09:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<f2s6vGZDs7S594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Nov 12 20:09:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PBc/umZD/8K594lc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.95
country_id: 2635167
description:
Nov 12 20:10:17 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.95, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<P6s1vmZDqYBX7LBf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-12 20:10:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:44162: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.240.103
country_id: 1269750
description:
Nov 12 20:10:40 host2 sshd[1959457]: Disconnected from invalid user user 49.207.240.103 port 56831 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Nov 12 20:10:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<1yMxwGZDudW594ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.106
country_id: 2635167
description:
Nov 12 20:11:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<TYgqwmZDYbC594lq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.84
country_id: 2635167
description:
Nov 12 20:13:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<DJYcyGZDm9FX7LBU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-12 20:12:22 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:55392: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.86
country_id: 2635167
description:
Nov 12 20:12:30 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.86, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<JhEjxmZDQdm594lW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-12 20:12:34 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:49336: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.240.103
country_id: 1269750
description:
Nov 12 20:13:27 host2 sshd[1961236]: Disconnected from invalid user wg 49.207.240.103 port 56486 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.105
country_id: 2635167
description:
Nov 12 20:13:36 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<0/wXymZDrcRX7LBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-11-12 20:14:11 dovecot_login authenticator failed for ([128.185.223.185]) [27.123.114.190]:54240: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-11-12 20:17:04 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:53135: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 20:17:49 host2 sshd[1964253]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.240.103
country_id: 1269750
description:
Nov 12 20:17:37 host2 sshd[1964146]: Disconnected from invalid user mike 49.207.240.103 port 56628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.149.213.8
country_id: 6252001
description:
2025-11-12 20:17:40 dovecot_login authenticator failed for ([168.149.213.8]) [168.149.213.8]:54889: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.240.103
country_id: 1269750
description:
Nov 12 20:19:00 host2 sshd[1965088]: Disconnected from invalid user test02 49.207.240.103 port 56284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 20:19:22 host2 sshd[1965475]: Disconnected from invalid user user 2.57.121.25 port 51127 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.9
country_id: 6252001
description:
Nov 12 20:19:52 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.9, lip=66.85.158.91, session=<ybSE4GZDYMyYINAJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 12 20:19:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<PUG/4GZDGp9ChJl3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.9
country_id: 6252001
description:
Nov 12 20:20:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.208.9, lip=66.85.158.91, session=<2viZ4WZDaMyYINAJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-12 20:21:01 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:60696: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-12 20:21:30 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:49746: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.9
country_id: 6252001
description:
Nov 12 20:22:11 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.9, lip=66.85.158.92, session=<ig/K6GZDzr2YINAJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-11-12 20:22:18 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:52313: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-12 20:22:25 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:54920: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.157
country_id: 6252001
description:
2025-11-12 20:27:40 dovecot_login authenticator failed for (ADMIN) [156.146.39.157]:9524: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-11-12 20:30:40 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:48639: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-12 20:30:51 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:36848: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-11-12 20:34:52 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:46502: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 12 20:35:05 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS: Connection closed, session=<D6zxFmdDwBBChJlz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.154.231.179
country_id: 2921044
description:
Nov 12 20:35:30 host2 pure-ftpd[1975056]: (?@207.154.231.179) [INFO] New connection from 207.154.231.179


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.25.213
country_id: 2921044
description:
Nov 12 20:35:30 host2 pure-ftpd[1975062]: (?@165.22.25.213) [INFO] New connection from 165.22.25.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-11-12 20:38:10 dovecot_plain authenticator failed for (mancher) [84.238.92.245]:38741: 535 Incorrect authentication data (set_id=news@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.1.235
country_id: 2017370
description:
2025-11-12 20:38:50 dovecot_login authenticator failed for ([155.212.1.235]) [155.212.1.235]:54448: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-12 20:39:01 dovecot_login authenticator failed for ([127.0.0.1]) [194.158.224.90]:47968: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-11-12 20:39:06 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:50588: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.30.185.35
country_id: 1252634
description:
2025-11-12 20:39:16 dovecot_login authenticator failed for ([127.0.0.1]) [160.30.185.35]:37292: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.106.246
country_id: 6252001
description:
2025-11-12 20:39:28 dovecot_login authenticator failed for ([134.22.106.246]) [134.22.106.246]:46912: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-12 20:39:39 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:47264: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-12 20:39:14 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51574: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 20:43:59 host2 sshd[1979626]: Disconnected from invalid user chantel 62.60.131.157 port 49622 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.189
country_id: 6252001
description:
Nov 12 20:51:02 host2 pure-ftpd[1984363]: (?@147.185.132.189) [INFO] New connection from 147.185.132.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.176
country_id: 6251999
description:
2025-11-12 20:51:39 dovecot_login authenticator failed for (ADMIN) [91.193.6.176]:42772: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-12 20:54:48 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:45866: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.252
country_id: 1733045
description:
2025-11-12 20:55:14 dovecot_login authenticator failed for ([49.124.152.252]) [49.124.152.252]:52604: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.195
country_id: 6252001
description:
Nov 12 20:57:15 host2 pure-ftpd[1988697]: (?@184.105.247.195) [INFO] New connection from 184.105.247.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-12 20:57:53 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:34014: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-12 20:58:19 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:54570: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-12 20:59:14 dovecot_plain authenticator failed for (otophon) [65.20.204.193]:36387: 535 Incorrect authentication data (set_id=news@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-12 21:01:59 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:45945: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-12 21:02:25 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:55002: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-12 21:02:54 dovecot_plain authenticator failed for (munisoatic) [81.0.54.119]:52093: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.141
country_id: 1210997
description:
2025-11-12 21:13:41 dovecot_login authenticator failed for (ADMIN) [64.64.112.141]:52595: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-12 21:13:44 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:53429: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-12 21:13:45 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:40916: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-12 21:13:50 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:36196: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-12 21:13:58 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:60976: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-12 21:14:06 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:38562: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-12 21:13:42 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:43687: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.12
country_id: 6252001
description:
Nov 12 21:17:49 host2 pure-ftpd[2000127]: (?@198.235.24.12) [INFO] New connection from 198.235.24.12


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 21:18:12 host2 sshd[2000301]: Disconnected from invalid user reese 62.60.131.157 port 44248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-12 21:18:46 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:48024: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-11-12 21:30:12 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:38070: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.215
country_id: 1733045
description:
2025-11-12 21:30:30 dovecot_login authenticator failed for ([49.124.152.215]) [49.124.152.215]:35514: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 21:32:59 host2 sshd[2010775]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.31
country_id: 1733045
description:
2025-11-12 21:34:15 dovecot_login authenticator failed for ([49.124.148.31]) [49.124.148.31]:42014: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-12 21:34:50 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:53651: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.22.82
country_id: 2921044
description:
Nov 12 21:35:02 host2 pure-ftpd[2012424]: (?@157.230.22.82) [INFO] New connection from 157.230.22.82


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 157.230.22.82
country_id: 2921044
description:
Nov 12 21:35:05 host2 pure-ftpd[2012566]: (?@157.230.22.82) [INFO] New connection from 157.230.22.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-12 21:35:12 dovecot_login authenticator failed for (177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:47783: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.21
country_id: 6252001
description:
2025-11-12 21:39:52 dovecot_login authenticator failed for (ftth-139-60-85-21.hamiltoncom.net) [139.60.85.21]:34641: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.37
country_id: 2802361
description:
2025-11-12 21:41:28 dovecot_login authenticator failed for (ADMIN) [181.214.218.37]:50757: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.32.62
country_id: 1269750
description:
2025-11-12 21:42:57 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [49.43.32.62]:47856: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-12 21:43:18 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:36020: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.99.2
country_id: 6252001
description:
2025-11-12 21:43:49 dovecot_plain authenticator failed for (luenes) [142.79.99.2]:53786: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.0
country_id: 6252001
description:
Nov 12 21:44:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.0, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DWdtDmhDzpIUQGkA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.143
country_id: 6252001
description:
Nov 12 21:44:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.143, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LtxtEGhDhpsUQGiP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-11-12 21:45:00 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:50616: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-11-12 21:45:17 dovecot_login authenticator failed for (SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:40444: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.72
country_id: 130758
description:
2025-11-12 21:47:14 H=([62.60.130.72]) [62.60.130.72]:58420 F=<info@wikipedia.org> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 21:51:24 host2 sshd[2036043]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov 12 21:51:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<CIGMKGhDgEFChJmP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-12 21:51:42 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:57046: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 12 21:55:39 host2 sshd[2039419]: Disconnected from invalid user user 2.57.121.25 port 31567 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.123
country_id: 298795
description:
2025-11-12 21:55:49 dovecot_plain authenticator failed for (suminess) [5.11.143.123]:39836: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.29
country_id: 2017370
description:
Nov 12 21:57:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=178.22.24.29, lip=66.85.158.92, session=<V2IDPWhDZv2yFhgd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-12 22:01:25 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:53520: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.255.226
country_id: 6252001
description:
2025-11-12 22:05:25 dovecot_login authenticator failed for (ADMIN) [191.96.255.226]:63918: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Nov 12 22:10:29 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.10, lip=66.85.158.92, TLS: Connection closed, session=<V+UWbGhDgmJAPpwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.11
country_id: 6252001
description:
Nov 12 22:10:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.11, lip=66.85.158.92, session=<ooRGa2hDEXhAPpwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Nov 12 22:10:42 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.10, lip=66.85.158.92, session=<h7zebGhD4tNAPpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-12 22:16:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57356: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-12 22:18:38 dovecot_plain authenticator failed for (hederb) [65.20.129.67]:49737: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:23:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<3uMvmmhD9McDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.46
country_id: 6251999
description:
2025-11-12 22:23:24 dovecot_login authenticator failed for (ADMIN) [181.214.153.46]:23179: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:23:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<kPjam2hDALcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Nov 12 22:24:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<lRPKnmhDptYjy9OT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:25:20 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Vh44oWhDBtUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:25:49 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<x5LpomhDhIEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Nov 12 22:25:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<rg45omhDzvcjy9OT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.163.205.133
country_id: 6252001
description:
Nov 12 22:25:46 host2 pure-ftpd[2059196]: (?@54.163.205.133) [INFO] New connection from 54.163.205.133


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-12 22:25:47 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (cabalos) [174.169.224.27]:60262: 535 Incorrect authentication data (set_id=news@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 12 22:27:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS handshaking: Connection closed, session=<x26Pp2hDattBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:27:23 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<RTKOqGhDaqwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 12 22:27:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS: Connection closed, session=<OXKyqWhDHIRBMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:27:52 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<AfpAqmhDtMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:28:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<GwYHrWhDhKgDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:29:16 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<wFtKr2hDsokDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:29:43 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<KPPjsGhDnMYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 12 22:30:51 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<TzTrtGhD2o0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.147
country_id: 2635167
description:
Nov 12 22:31:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.147, lip=66.85.158.91, TLS, session=</i+Jt2hDXO0jy9OT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 12 22:35:16 host2 sshd[2064999]: Disconnected from invalid user  2.57.121.112 port 61511 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 12 22:46:20 host2 sshd[2072473]: Disconnected from invalid user guru 146.190.154.85 port 39956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-12 22:46:37 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:52696: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-12 22:49:22 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:52644: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 12 22:50:34 host2 sshd[2074652]: Disconnected from invalid user zeeshan 146.190.154.85 port 46090 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.201
country_id: 6252001
description:
Nov 12 22:50:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.201, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<DOHF+2hDXt2i2JbJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.201
country_id: 6252001
description:
Nov 12 22:51:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.201, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<DTY2/2hDvvGi2JbJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 12 22:51:43 host2 sshd[2075351]: Disconnected from invalid user agent 146.190.154.85 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-11-12 22:54:50 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:56108: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.72
country_id: 130758
description:
2025-11-12 22:56:40 H=([62.60.130.72]) [62.60.130.72]:56064 F=<info@wikipedia.org> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 12 22:57:17 host2 sshd[2078748]: Disconnected from invalid user khan 146.190.154.85 port 36184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-12 22:57:47 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:41882: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-12 22:58:12 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:52700: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 22:58:21 host2 sshd[2079246]: Disconnected from invalid user stefanie 62.60.131.157 port 43325 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.201
country_id: 6252001
description:
Nov 12 22:58:54 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.201, lip=66.85.158.92, TLS, session=<srtDGWlDQvOi2JbJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.90
country_id: 1880251
description:
Nov 12 23:02:03 host2 sshd[2082046]: Disconnected from invalid user umair 45.78.221.90 port 40514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.127
country_id: 6252001
description:
Nov 12 23:08:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.127, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KrHZOmlDtcVBMQF/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-12 23:07:38 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:46622: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 12 23:08:13 host2 sshd[2086661]: Disconnected from invalid user stefanie 62.60.131.157 port 18856 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 23:08:59 host2 sshd[2087095]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-12 23:09:21 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:51664: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Nov 12 23:08:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z2DdO2lDQohBMQF6>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.72
country_id: 130758
description:
2025-11-12 23:09:14 H=([62.60.130.72]) [62.60.130.72]:62360 F=<info@applianceicon.com> rejected RCPT <chartering@petromarinegroup.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-12 23:10:16 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:47632: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-12 23:09:42 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:38540: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.197.158
country_id: 3469034
description:
Nov 12 23:11:28 host2 sshd[2088640]: Disconnected from invalid user jackie 43.164.197.158 port 60150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov 12 23:11:32 host2 sshd[2088697]: Disconnected from invalid user rstudio 146.190.93.207 port 36026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.118.101.49
country_id: 130758
description:
Nov 12 23:13:02 host2 sshd[2089774]: Disconnected from invalid user ss 93.118.101.49 port 45048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov 12 23:14:21 host2 sshd[2091019]: Disconnected from invalid user felipe 146.190.93.207 port 58406 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.93.207
country_id: 1880251
description:
Nov 12 23:15:47 host2 sshd[2092054]: Disconnected from invalid user jin 146.190.93.207 port 56112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov 12 23:17:11 host2 sshd[2092853]: Disconnected from invalid user santana 146.190.93.207 port 54166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-12 23:18:01 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:58000: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.197.158
country_id: 3469034
description:
Nov 12 23:18:37 host2 sshd[2093940]: Disconnected from invalid user webkul 43.164.197.158 port 58396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 12 23:18:56 host2 sshd[2094070]: Disconnected from invalid user ftpuser 172.245.45.194 port 57294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 12 23:19:34 host2 sshd[2094430]: Disconnected from invalid user ss 168.194.164.218 port 35277 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov 12 23:20:02 host2 sshd[2094670]: Disconnected from invalid user remote 146.190.93.207 port 42380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Nov 12 23:21:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, session=<ju9saWlDFL9APsVr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Nov 12 23:21:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS: Connection closed, session=<uk8yamlDPG1APsVr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 12 23:22:17 host2 sshd[2096070]: Disconnected from invalid user gitlab-runner 172.245.45.194 port 57672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.164.197.158
country_id: 3469034
description:
Nov 12 23:22:56 host2 sshd[2096390]: Disconnected from invalid user professor 43.164.197.158 port 47832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 12 23:23:24 host2 sshd[2096850]: Disconnected from invalid user braun 172.245.45.194 port 57798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.197.158
country_id: 3469034
description:
Nov 12 23:25:58 host2 sshd[2098554]: Disconnected from invalid user server 43.164.197.158 port 47160 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 12 23:27:14 host2 sshd[2099221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.45.194
country_id: 6252001
description:
Nov 12 23:27:59 host2 sshd[2099577]: Disconnected from invalid user suser 172.245.45.194 port 58284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.82
country_id: 390903
description:
2025-11-12 23:31:39 dovecot_login authenticator failed for (ADMIN) [79.127.181.82]:19530: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 12 23:32:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YZOMkWlDfIwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 12 23:32:59 host2 sshd[2103776]: Disconnected from invalid user ftpuser 168.194.164.218 port 33328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 12 23:34:20 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<3Jv1l2lD7LkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 12 23:34:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aao/mWlDuuwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 12 23:36:00 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sfvwnWlDiLUDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 12 23:36:32 host2 sshd[2106143]: Disconnected from invalid user gitlab-runner 168.194.164.218 port 37654 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 12 23:37:30 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<HeZQo2lDtOADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Nov 12 23:39:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<j7+yqWlD79DN0h9Y>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 12 23:43:36 host2 sshd[2110808]: Disconnected from invalid user suser 168.194.164.218 port 46744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-11-12 23:45:08 dovecot_login authenticator failed for ([127.0.0.1]) [121.73.168.216]:51736: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.98.73
country_id: 6252001
description:
2025-11-12 23:45:15 dovecot_login authenticator failed for ([127.0.0.1]) [104.37.98.73]:41797: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 12 23:46:40 host2 sshd[2113628]: Disconnected from invalid user jonathan 185.158.22.150 port 11618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.110
country_id: 1269750
description:
2025-11-12 23:48:20 dovecot_login authenticator failed for ([122.185.184.56]) [125.19.161.110]:53818: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 12 23:48:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9ovby2lDCqtAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.125
country_id: 6252001
description:
Nov 12 23:48:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.125, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bI2/ymlDHUdAPpx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-11-12 23:48:42 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Nov 12 23:56:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.184, lip=66.85.158.92, session=<DzUj5mlDbOXG6xi4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.181.158.184
country_id: 1527747
description:
Nov 12 23:56:17 host2 pure-ftpd[2121284]: (?@158.181.158.184) [INFO] New connection from 158.181.158.184


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Nov 12 23:56:45 host2 sshd[2121758]: Disconnected from invalid user jesus 185.158.22.150 port 58403 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 12 23:57:58 host2 sshd[2122739]: Disconnected from invalid user patrol 185.158.22.150 port 53251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 12 23:59:10 host2 sshd[2124080]: Disconnected from invalid user diquest 185.158.22.150 port 25164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-13 00:00:22 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:49986: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-13 00:00:40 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:53814: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 13 00:01:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9eBO+WlDmoxBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.94
country_id: 1149361
description:
2025-11-13 00:25:16 dovecot_login authenticator failed for ([180.94.74.94]) [180.94.74.94]:50741: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-13 00:24:55 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:52222: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-13 00:25:33 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:35933: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.240.104
country_id: 3469034
description:
Nov 13 00:28:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.92.240.104, lip=66.85.158.91, TLS, session=<tR7fWGpDF4qxXPBo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.61.153.63
country_id: 2510769
description:
Nov 13 00:28:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=37.61.153.63, lip=66.85.158.91, TLS, session=<0k8NWmpDkbIlPZk/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 00:29:58 host2 sshd[2143252]: Disconnected from invalid user user 2.57.121.25 port 36419 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.46
country_id: 2658434
description:
2025-11-13 00:30:32 dovecot_login authenticator failed for (ADMIN) [158.173.152.46]:41600: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 00:31:25 host2 sshd[2144417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 00:31:55 host2 sshd[2144676]: Disconnected from invalid user admin 2.57.121.112 port 6219 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-13 00:36:19 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:2102: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 00:41:18 host2 sshd[2151148]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-13 00:47:54 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:47108: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-13 00:48:07 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:40740: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.81
country_id: 6252001
description:
2025-11-13 00:51:32 dovecot_login authenticator failed for (ADMIN) [102.129.153.81]:19014: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 00:51:59 host2 sshd[2157897]: Disconnected from invalid user support 2.57.121.112 port 61535 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 00:59:33 host2 sshd[2162942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-13 01:00:16 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:37946: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.7
country_id: 2921044
description:
[2025-11-13 01:10:46 +0530] info [cpaneld] 65.111.24.7 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 01:13:02 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:40384: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.119.40.152
country_id: 6252001
description:
Nov 13 01:24:18 host2 pure-ftpd[2177271]: (?@40.119.40.152) [INFO] New connection from 40.119.40.152


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 13 01:26:56 host2 sshd[2178812]: Disconnected from invalid user gmodserver 103.159.199.42 port 42778 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 01:28:47 host2 sshd[2179974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.100
country_id: 6252001
description:
Nov 13 01:30:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hTGHN2tDEtaTuYRk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 13 01:30:57 host2 sshd[2181340]: Disconnected from invalid user ftpuser3 103.159.199.42 port 39206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-13 01:31:27 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:37588: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.81.45.147
country_id: 6252001
description:
2025-11-13 01:31:46 dovecot_login authenticator failed for ([172.81.45.147]) [172.81.45.147]:53931: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 13 01:32:30 host2 sshd[2182127]: Disconnected from invalid user subzero 103.159.199.42 port 48798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Nov 13 01:32:58 host2 sshd[2182276]: Disconnected from invalid user data 191.223.75.89 port 37926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-13 01:33:42 dovecot_login authenticator failed for ([182.95.22.221]) [125.19.251.90]:44776: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-13 01:33:58 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:35328: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Nov 13 01:34:28 host2 sshd[2183120]: Disconnected from invalid user pp 191.223.75.89 port 39828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.22
country_id: 6252001
description:
2025-11-13 01:36:17 dovecot_login authenticator failed for (ADMIN) [95.181.238.22]:44670: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.199.42
country_id: 1643084
description:
Nov 13 01:37:58 host2 sshd[2185808]: Disconnected from invalid user dev 103.159.199.42 port 34244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-13 01:39:23 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:57925: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-11-13 01:38:47 dovecot_login authenticator failed for (nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:51283: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-13 01:39:05 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:59330: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 01:39:59 host2 sshd[2187223]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.223.75.89
country_id: 3469034
description:
Nov 13 01:41:41 host2 sshd[2188363]: Disconnected from invalid user dolphinscheduler 191.223.75.89 port 49330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Nov 13 01:43:16 host2 sshd[2189161]: Disconnected from invalid user az 191.223.75.89 port 51248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-11-13 01:45:16 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:55854: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-13 01:45:27 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:34792: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.249
country_id: 6252001
description:
Nov 13 01:46:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.249, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dhHvb2tDOsPN0h/5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-11-13 01:47:46 dovecot_plain authenticator failed for (pregist) [91.73.188.251]:54451: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 01:50:42 host2 sshd[2195254]: Disconnected from invalid user admin 2.57.121.112 port 41545 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.114.138
country_id: 3057568
description:
Nov 13 01:52:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=91.226.114.138, lip=66.85.158.91, TLS, session=<EQlohWtDtNBb4nKK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.143
country_id: 3865483
description:
Nov 13 01:53:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.109.143, lip=66.85.158.91, TLS, session=<c0TehmtDPpC+tW2P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
country_id: 294640
description:
2025-11-13 01:54:03 dovecot_login authenticator failed for ([2.55.64.191]) [2.55.64.191]:45309: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.132
country_id: 2328926
description:
2025-11-13 02:03:34 dovecot_login authenticator failed for (ADMIN) [146.70.65.132]:6086: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 02:06:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52723: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 02:13:31 host2 sshd[2210890]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-13 02:15:29 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:35986: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-13 02:15:39 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:50358: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.246
country_id: 3469034
description:
Nov 13 02:20:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.107.246, lip=66.85.158.91, TLS, session=<K4xI52tD0LW/NWv2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.221
country_id: 2300660
description:
Nov 13 02:20:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.37.221, lip=66.85.158.91, TLS, session=<ys026WtDzpMpiyXd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-13 02:22:11 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:41330: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-13 02:22:01 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:47642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-13 02:24:11 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:58204: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-13 02:24:30 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:59762: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.167
country_id: 6252001
description:
2025-11-13 02:26:13 dovecot_login authenticator failed for (ADMIN) [191.96.67.167]:40394: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 02:31:43 host2 sshd[2221783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-13 02:36:44 dovecot_plain authenticator failed for (cityle) [76.190.155.43]:43783: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-11-13 02:36:48 dovecot_plain authenticator failed for (subethedly) [46.35.178.104]:33382: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 13 02:36:56 host2 sshd[2224676]: Disconnected from invalid user postgres 197.5.145.102 port 48189 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 13 02:39:15 host2 sshd[2226137]: Disconnected from invalid user ansible 197.5.145.102 port 48191 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 13 02:46:15 host2 sshd[2230781]: Disconnected from invalid user n 197.5.145.102 port 48197 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-13 02:46:28 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (unchal) [82.32.230.230]:55014: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-11-13 02:46:39 dovecot_plain authenticator failed for (logelle) [96.85.104.2]:56216: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.239.222
country_id: 3374766
description:
2025-11-13 02:51:32 dovecot_login authenticator failed for ([154.203.239.222]) [154.203.239.222]:38602: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-13 02:52:03 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54166: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.192
country_id: 6252001
description:
Nov 13 02:53:04 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.234.217.192, lip=66.85.158.91, session=<9kq5XmxDNtWs6tnA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-13 02:54:15 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:49980: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-13 02:53:58 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:34135: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.39.73.186
country_id: 6252001
description:
2025-11-13 02:58:29 dovecot_login authenticator failed for (static-50-39-73-186.bvtn.or.ptr.ziplyfiber.com) [50.39.73.186]:36531: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-13 02:58:41 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:49414: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 03:01:11 host2 sshd[2239626]: Disconnected from invalid user user 2.57.121.25 port 49023 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 13 03:04:56 host2 pure-ftpd[2241952]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-13 03:06:03 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:64800: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.254.16.242
country_id: 6252001
description:
2025-11-13 03:06:12 dovecot_login authenticator failed for ([195.78.55.50]) [165.254.16.242]:32922: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.68
country_id: 3077311
description:
2025-11-13 03:09:44 dovecot_login authenticator failed for (ADMIN) [212.102.39.68]:38984: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 03:13:16 host2 sshd[2247270]: Disconnected from invalid user admin 2.57.121.112 port 26887 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-11-13 03:13:36 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:36395: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.222
country_id: 6252001
description:
Nov 13 03:18:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.222, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DJJKuWxDIdTN0h/e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-13 03:20:03 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:41128: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-13 03:20:23 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:60128: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-13 03:27:30 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:42017: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-13 03:27:31 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (andess) [82.32.230.230]:51740: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-13 03:27:49 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:42973: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-11-13 03:34:04 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:53217: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.250.166.16
country_id: 1861060
description:
2025-11-13 03:33:44 dovecot_login authenticator failed for c122250166016.v4.c-able.ne.jp [122.250.166.16]:49416: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.88
country_id: 2300660
description:
Nov 13 03:34:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.28.88, lip=66.85.158.91, TLS, session=<xJFG8mxDDJUpixxY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.186
country_id: 953987
description:
Nov 13 03:35:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=102.129.57.186, lip=66.85.158.91, TLS, session=</gKT82xDK+FmgTm6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.43
country_id: 6252001
description:
Nov 13 03:37:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.43, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AgxC/WxD18fG6xgr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-11-13 03:38:08 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:53576: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-11-13 03:38:20 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:40514: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 03:45:30 host2 sshd[2266206]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 13 03:45:52 host2 sshd[2266402]: Disconnected from invalid user fox 190.221.50.123 port 35998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.150
country_id: 2328926
description:
2025-11-13 03:47:10 dovecot_login authenticator failed for (ADMIN) [146.70.65.150]:36273: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.67
country_id: 798544
description:
Nov 13 03:46:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=91.231.121.67, lip=66.85.158.91, TLS, session=<v2aPHG1Dwupb53lD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.214
country_id: 1269750
description:
Nov 13 03:46:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.207.4.214, lip=66.85.158.91, TLS, session=<zM6rHW1DZaZnzwTW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.89
country_id: 3469034
description:
Nov 13 03:46:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=179.189.199.89, lip=66.85.158.91, TLS, session=<iIfFHW1DMsuzvcdZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-13 03:47:02 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:35650: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.160
country_id: 3469034
description:
Nov 13 03:47:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=177.130.171.160, lip=66.85.158.91, TLS, session=<qvTrHm1D+ZGxgqug>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 13 03:50:05 host2 sshd[2268699]: Disconnected from invalid user production 190.221.50.123 port 38358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-13 03:49:20 dovecot_login authenticator failed for ([152.52.184.121]) [122.186.243.78]:50848: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 13 03:50:29 host2 sshd[2269076]: Disconnected from invalid user mehrdad 103.248.120.6 port 50205 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-11-13 03:50:31 dovecot_login authenticator failed for ([79.98.102.173]) [182.95.177.118]:53796: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-13 03:50:48 dovecot_login authenticator failed for ([82.200.223.49]) [200.216.168.226]:52095: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 13 03:51:37 host2 sshd[2269837]: Disconnected from invalid user macuser 103.187.165.26 port 33302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-11-13 03:51:41 dovecot_login authenticator failed for ([77.35.96.85]) [122.187.230.34]:50155: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 13 03:53:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.91, session=<to9cNm1DTqlo7NEL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 13 03:54:31 host2 sshd[2271883]: Disconnected from invalid user testuser2 103.187.165.26 port 33852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 13 03:55:27 host2 sshd[2272558]: Disconnected from invalid user abc 190.221.50.123 port 50574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 13 03:55:59 host2 sshd[2272769]: Disconnected from invalid user kevin 103.248.120.6 port 60667 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 13 03:57:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LBTMQ21D8JBChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 13 03:57:09 host2 sshd[2273534]: Disconnected from invalid user yangx 190.221.50.123 port 34428 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.254
country_id: 6252001
description:
Nov 13 03:57:59 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.65.193.254, lip=66.85.158.91, session=<gFzTRm1DGI4UQcH+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 13 03:58:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<RJHbR21DEH1ChJlw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 13 03:58:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS, session=<OY5KSG1DGn1ChJlw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 13 03:58:54 host2 sshd[2275093]: Disconnected from invalid user kevin 190.221.50.123 port 49986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-11-13 04:00:00 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:34398: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 13 04:01:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<E7bMUm1DKjVChJl/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 04:03:37 host2 sshd[2279878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 13 04:03:57 host2 sshd[2280241]: Disconnected from invalid user ww 103.248.120.6 port 59341 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.12
country_id: 6252001
description:
Nov 13 04:06:01 host2 pure-ftpd[2281754]: (?@91.230.168.12) [INFO] New connection from 91.230.168.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2025-11-13 04:10:51 dovecot_login authenticator failed for ([49.124.155.189]) [49.124.155.189]:53350: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-13 04:10:32 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:50860: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.231
country_id: 2658434
description:
2025-11-13 04:15:48 dovecot_login authenticator failed for (ADMIN) [158.173.152.231]:55950: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.64.148
country_id: 6252001
description:
Nov 13 04:17:19 host2 sshd[2291892]: Disconnected from invalid user testuser2 138.197.64.148 port 45574 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.203.233
country_id: 6251999
description:
Nov 13 04:17:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.203.233, lip=66.85.158.92, session=<D3dEjG1DAq+Ay8vp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-13 04:19:04 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:50244: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.64.148
country_id: 6252001
description:
Nov 13 04:21:07 host2 sshd[2296145]: Disconnected from invalid user kevin 138.197.64.148 port 39838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-13 04:21:43 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:57062: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-11-13 04:21:58 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:42316: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.64.148
country_id: 6252001
description:
Nov 13 04:22:59 host2 sshd[2298075]: Disconnected from invalid user mehrdad 138.197.64.148 port 45370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov 13 04:25:41 host2 sshd[2301125]: Disconnected from invalid user fox 103.248.120.6 port 37087 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.64.148
country_id: 6252001
description:
Nov 13 04:28:44 host2 sshd[2303951]: Disconnected from invalid user macuser 138.197.64.148 port 34306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-11-13 04:30:08 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (micolothum) [69.142.126.37]:37794: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-11-13 04:30:48 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:51809: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-13 04:31:06 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:36784: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.34.231
country_id: 6290252
description:
2025-11-13 04:33:02 dovecot_login authenticator failed for (dyn-34-231.kbcnet.rs) [109.207.34.231]:44672: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.54.97.251
country_id: 3469034
description:
2025-11-13 04:32:47 dovecot_login authenticator failed for (177.54.97.251.plenatelecom.com.br) [177.54.97.251]:57726: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.56
country_id: 2629691
description:
2025-11-13 04:37:06 dovecot_login authenticator failed for (ADMIN) [45.133.193.56]:3169: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-11-13 04:43:36 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:16619: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.240.125.200
country_id: 2635167
description:
2025-11-13 04:44:00 dovecot_login authenticator failed for host-89-240-125-200.as13285.net [89.240.125.200]:42543: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Nov 13 04:46:16 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<46CC821Dci5ChJmI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.207
country_id: 6252001
description:
Nov 13 04:49:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.207, lip=66.85.158.92, session=<obSA/21Ds7Vb5qjP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.205
country_id: 6252001
description:
Nov 13 04:49:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.205, lip=66.85.158.92, session=<LbIaAG5DU4hb5qjN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.7.67
country_id: 2215636
description:
Nov 13 04:49:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=5.63.7.67, lip=66.85.158.91, TLS, session=<m4qr/21DIKUFPwdD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.189
country_id: 3469034
description:
Nov 13 04:50:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=187.120.73.189, lip=66.85.158.91, TLS, session=<ewTLAG5DXdG7eEm9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-11-13 04:52:18 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:41540: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.191.73.38
country_id: 6252001
description:
2025-11-13 04:52:49 dovecot_login authenticator failed for ([162.191.73.38]) [162.191.73.38]:46580: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-11-13 04:54:41 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:46905: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-13 04:54:58 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:49408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-13 04:59:43 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (favinchron) [73.213.236.66]:33500: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-13 04:59:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (treouts) [71.62.34.216]:35378: 535 Incorrect authentication data (set_id=sales@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.10
country_id: 174982
description:
2025-11-13 05:01:36 dovecot_login authenticator failed for (ADMIN) [185.253.160.10]:39174: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 13 05:05:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS: Connection closed, session=<N5vgN25DmIvLN4ME>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-13 05:06:06 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:54427: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.53
country_id: 6252001
description:
Nov 13 05:06:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.53, lip=66.85.158.91, session=<HsgMPG5D9unG6xg1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-13 05:10:15 dovecot_plain authenticator failed for (busteed) [65.20.186.177]:39640: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.86.176.18
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 103.86.176.18: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.86.176.18
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 103.86.176.18: 2873 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.98
country_id: 3017382
description:
Nov 13 05:12:30 host2 pure-ftpd[2335299]: (?@91.196.152.98) [INFO] New connection from 91.196.152.98


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.13
country_id: 3017382
description:
Nov 13 05:12:31 host2 pure-ftpd[2335319]: (?@91.196.152.13) [INFO] New connection from 91.196.152.13


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Nov 13 05:14:02 host2 sshd[2336867]: Disconnected from invalid user agenda 202.165.15.132 port 60534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.164.59
country_id: 798544
description:
Nov 13 05:14:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.232.164.59, lip=66.85.158.91, TLS, session=</AlQV25Do4Jb6KQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.44
country_id: 953987
description:
Nov 13 05:14:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.62.44, lip=66.85.158.91, TLS, session=<fSlsWG5DnZlmgT4s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-13 05:16:52 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:55244: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 05:17:17 host2 sshd[2339327]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-13 05:17:16 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:36110: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-13 05:17:44 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (tentor) [81.225.30.107]:60013: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 05:23:30 host2 sshd[2343856]: Disconnected from invalid user  2.57.121.112 port 61572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.22
country_id: 3625428
description:
2025-11-13 05:24:50 dovecot_login authenticator failed for (ADMIN) [95.181.237.22]:45867: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-11-13 05:28:20 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:54271: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.254.16.242
country_id: 6252001
description:
2025-11-13 05:28:39 dovecot_login authenticator failed for ([195.78.55.38]) [165.254.16.242]:45730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 05:30:58 host2 sshd[2348994]: Disconnected from invalid user  2.57.121.112 port 62659 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 05:35:28 host2 sshd[2352596]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-13 05:38:54 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:48314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-13 05:38:47 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:53313: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-13 05:39:35 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:45587: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-13 05:39:47 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:34916: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.92.195
country_id: 1269750
description:
Nov 13 05:40:27 host2 sshd[2356148]: Disconnected from invalid user user1 103.172.92.195 port 46084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 05:41:31 host2 sshd[2356927]: Disconnected from invalid user admin 2.57.121.112 port 15079 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.92.195
country_id: 1269750
description:
Nov 13 05:41:55 host2 sshd[2357243]: Disconnected from invalid user sachin 103.172.92.195 port 56050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.92.195
country_id: 1269750
description:
Nov 13 05:43:15 host2 sshd[2358237]: Disconnected from invalid user ipfs 103.172.92.195 port 38664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 05:43:24 host2 sshd[2358364]: Disconnected from invalid user user 2.57.121.25 port 34603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 05:45:43 host2 sshd[2360905]: Disconnected from invalid user admin 2.57.121.112 port 18641 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-11-13 05:46:51 dovecot_plain authenticator failed for (ovier) [105.114.21.51]:50043: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-13 05:46:47 dovecot_plain authenticator failed for (degate) [154.144.255.209]:56698: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 05:47:13 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61196: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.92.195
country_id: 1269750
description:
Nov 13 05:48:32 host2 sshd[2362668]: Disconnected from invalid user test1 103.172.92.195 port 59094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-13 05:51:03 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:60746: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-13 05:51:16 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:54074: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.7
country_id: 732800
description:
2025-11-13 05:51:40 dovecot_login authenticator failed for (ADMIN) [94.156.14.7]:62686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.251.104
country_id: 99237
description:
Nov 13 05:53:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=65.20.251.104, lip=66.85.158.91, TLS, session=<6Ke34W5DPsBBFPto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.183
country_id: 3865483
description:
Nov 13 05:53:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<jagath.peiris>, method=PLAIN, rip=45.238.106.183, lip=66.85.158.91, TLS, session=<ID0f425Dpt8t7mq3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.113.208.46
country_id: 6252001
description:
2025-11-13 05:54:58 dovecot_login authenticator failed for 46.208.113.136.bc.googleusercontent.com [136.113.208.46]:55686: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.60
country_id: 6252001
description:
Nov 13 05:57:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.60, lip=66.85.158.92, TLS, session=<lTM0825DBP7G6xg8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-11-13 06:01:55 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:35383: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.202
country_id: 1269750
description:
2025-11-13 06:02:26 dovecot_login authenticator failed for (dsl-tn-dynamic-065.124.246.61.airtelbroadband.in) [27.123.101.202]:39550: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.114.83
country_id: 3057568
description:
Nov 13 06:06:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=91.226.114.83, lip=66.85.158.91, TLS, session=<xVmXEG9DRpFb4nJT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.66
country_id: 3865483
description:
Nov 13 06:06:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<jagath.peiris>, method=PLAIN, rip=181.225.195.66, lip=66.85.158.91, TLS, session=<aWfBEW9DdIa14cNC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-11-13 06:13:17 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:47775: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.176
country_id: 2623032
description:
2025-11-13 06:17:29 dovecot_login authenticator failed for (ADMIN) [188.126.94.176]:43492: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.32
country_id: 2264397
description:
Nov 13 06:18:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.32, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CizdO29DlLG5tI0g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.34
country_id: 2264397
description:
Nov 13 06:18:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ASXqO29Ddca5tI0i>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.34
country_id: 2264397
description:
Nov 13 06:18:04 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.34, lip=66.85.158.92, TLS, session=<nRjRO29DS6O5tI0i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.33
country_id: 2264397
description:
Nov 13 06:18:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.33, lip=66.85.158.92, TLS, session=<2oLgO29DtcG5tI0h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.203
country_id: 798544
description:
Nov 13 06:19:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=89.107.155.203, lip=66.85.158.91, TLS, session=<aTD4P29DbaVZa5vL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.37
country_id: 798544
description:
Nov 13 06:19:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=91.228.33.37, lip=66.85.158.91, TLS, session=<R8IKQW9DV+1b5CEl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-13 06:21:52 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:55988: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-13 06:22:17 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:60622: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2025-11-13 06:24:56 dovecot_login authenticator failed for ([167.250.118.12]) [167.250.118.12]:56352: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.133.16
country_id: 1819730
description:
Nov 13 06:26:29 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.133.16, lip=66.85.158.92, TLS, session=<wQPyWW9DkKyYIIUQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.133.16
country_id: 1819730
description:
Nov 13 06:26:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=152.32.133.16, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<sj8VWm9DILuYIIUQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 06:32:18 host2 sshd[2389104]: Disconnected from invalid user conrad 62.60.131.157 port 19106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 06:37:52 host2 sshd[2392423]: Disconnected from invalid user conrad 62.60.131.157 port 43734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.182
country_id: 2960313
description:
2025-11-13 06:39:47 dovecot_login authenticator failed for (ADMIN) [37.46.113.182]:53575: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.186.41
country_id: 2510769
description:
Nov 13 06:39:52 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=5.183.186.41, lip=66.85.158.91, TLS, session=<ZgDIiG9Dl54Ft7op>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.209.41
country_id: 3175395
description:
Nov 13 06:40:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=94.198.209.41, lip=66.85.158.91, TLS, session=<K2HeiW9D/OhextEp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-13 06:42:32 dovecot_plain authenticator failed for (ingue) [154.144.243.93]:44068: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.202
country_id: 1269750
description:
2025-11-13 06:44:17 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:50586: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-11-13 06:44:29 dovecot_login authenticator failed for (24-105-248-218.ip.mhcable.com) [24.105.248.218]:47860: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.191
country_id: 1733045
description:
2025-11-13 06:44:50 dovecot_login authenticator failed for ([49.124.148.191]) [49.124.148.191]:59106: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 06:49:29 host2 sshd[2399867]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.5
country_id: 1605651
description:
Nov 13 06:49:03 host2 pure-ftpd[2399648]: (?@103.176.152.5) [INFO] New connection from 103.176.152.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2025-11-13 06:49:16 dovecot_login authenticator failed for ([49.124.147.96]) [49.124.147.96]:53414: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-13 06:49:33 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:40164: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-13 06:51:20 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:47334: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-13 06:51:45 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:46002: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 06:57:13 host2 sshd[2405768]: Disconnected from invalid user admin 2.57.121.112 port 6184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-13 07:01:43 dovecot_login authenticator failed for ([213.91.179.26]) [213.91.179.26]:39002: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-11-13 07:02:14 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46369: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-13 07:05:55 dovecot_plain authenticator failed for (inerily) [24.187.213.29]:52660: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.56
country_id: 6252001
description:
Nov 13 07:05:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.56, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<B0YM529DosrN0h84>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 07:05:36 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:32792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 07:07:42 host2 sshd[2411896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-11-13 07:07:35 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:52396: 535 Incorrect authentication data


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 07:11:22 host2 sshd[2413692]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Nov 13 07:12:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.61, lip=66.85.158.92, TLS: Connection closed, session=<uIwy/29DuKWnXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:17:26 host2 sshd[2416738]: Disconnected from invalid user user1 165.22.63.108 port 39954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-13 07:20:31 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:36279: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:23:19 host2 sshd[2420144]: Disconnected from invalid user dat 165.22.63.108 port 40064 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:27:26 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.91, session=<hCDkM3BDkJ92wSQ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:27:45 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.91, session=<RH0KNXBDBMh2wSQ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:28:40 host2 sshd[2423338]: Disconnected from invalid user management 165.22.63.108 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:29:58 host2 sshd[2424217]: Disconnected from invalid user user 165.22.63.108 port 45458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:31:58 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.92, session=<f7EdRHBDsKZ2wSQ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.140
country_id: 298795
description:
2025-11-13 07:33:24 dovecot_login authenticator failed for (ADMIN) [188.213.34.140]:40106: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.252.89
country_id: 3469034
description:
Nov 13 07:33:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.8.252.89, lip=66.85.158.91, TLS, session=<voeoSHBDko6xCPxZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.147
country_id: 3469034
description:
Nov 13 07:33:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=177.44.71.147, lip=66.85.158.91, TLS, session=<P6PqSXBDLqKxLEeT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:34:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QtKrTHBD88ui2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:35:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<qGZUUHBDBP+i2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:35:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ShCFUXBDhvWi2JZ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:35:36 host2 sshd[2427484]: Disconnected from invalid user saas 91.108.245.181 port 47896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-11-13 07:37:18 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:53283: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:37:51 host2 sshd[2428494]: Disconnected from invalid user saas 103.132.243.250 port 52210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:39:21 host2 sshd[2429177]: Disconnected from invalid user botuser 91.108.245.181 port 47446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-13 07:39:41 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:57098: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-13 07:40:09 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:49734: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:40:34 host2 sshd[2429999]: Disconnected from invalid user jin 103.132.243.250 port 54494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:40:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS, session=<Y7XmYnBDZumi2JZ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 07:41:07 host2 sshd[2430394]: Disconnected from invalid user  2.57.121.112 port 62991 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:43:13 host2 sshd[2431289]: Disconnected from invalid user tt 103.132.243.250 port 46162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Nov 13 07:45:14 host2 sshd[2432799]: Disconnected from invalid user ubadmin 101.47.143.252 port 59838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-11-13 07:45:46 dovecot_plain authenticator failed for (masping) [185.214.169.10]:57149: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:45:58 host2 sshd[2433623]: Disconnected from invalid user web 91.108.245.181 port 57828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:48:42 host2 sshd[2434818]: Disconnected from invalid user myuser 91.108.245.181 port 55856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-13 07:49:35 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:42340: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.51
country_id: 298795
description:
2025-11-13 07:49:52 dovecot_login authenticator failed for (88.255.189.51.static.ttnet.com.tr) [88.255.189.51]:39277: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 07:56:58 host2 sshd[2440016]: Disconnected from invalid user test1 103.189.235.65 port 56638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 13 07:58:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<lfv/oXBDCtc2rEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Nov 13 07:57:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UZiooHBDxl9ChJmD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.110
country_id: 6252001
description:
2025-11-13 08:01:12 dovecot_login authenticator failed for (ADMIN) [173.244.56.110]:56486: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-13 08:01:40 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:45704: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 08:02:47 host2 sshd[2443200]: Disconnected from invalid user admin 103.189.235.65 port 41418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.104
country_id: 798544
description:
Nov 13 08:03:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=128.127.94.104, lip=66.85.158.91, TLS, session=</BuitHBDLNuAf15o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Nov 13 08:04:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<3si/tXBDjpe7eEhv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-13 08:04:59 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:57702: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-13 08:05:19 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:57086: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 08:05:56 host2 sshd[2445495]: Disconnected from invalid user andrew 103.189.235.65 port 51778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Nov 13 08:07:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<LNvgwXBDQJ0u4yfe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.43
country_id: 6252001
description:
Nov 13 08:06:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.43, lip=66.85.158.92, TLS, session=<W7fYv3BDrOaTuYQr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.46.170.61
country_id: 798544
description:
Nov 13 08:07:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.46.170.61, lip=66.85.158.91, TLS, session=<6J7pwnBDXO25Lqo9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 08:11:43 host2 sshd[2449302]: Disconnected from invalid user admin 2.57.121.112 port 29123 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Nov 13 08:19:08 host2 sshd[2453709]: Disconnected from invalid user ml 101.47.143.252 port 44926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:20:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1Ktz8XBDkLYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.27
country_id: 6252001
description:
2025-11-13 08:19:44 dovecot_login authenticator failed for (ADMIN) [216.24.213.27]:23964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:21:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<oqBe9HBDUIoDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 08:21:43 host2 sshd[2455377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:22:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=</VN8+HBDbtwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.19
country_id: 6252001
description:
Nov 13 08:23:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Bi3x/XBDqrOsynYT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:23:56 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<3Iv9/XBDptMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:24:36 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AB1bAHFD+osDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:24:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jmCSAXFDvL4DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:26:14 host2 sshd[2457497]: Disconnected from invalid user consultor 103.52.37.10 port 21921 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:27:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Ni8nCXFDlrkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:27:08 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<ugFjCXFDzOEDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 08:27:54 host2 sshd[2458095]: Disconnected from invalid user minecraft 102.140.97.134 port 51786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 13 08:28:09 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<U0cRDXFD7rkD7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:28:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iPDEDXFDALQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:29:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Sl2zEHFDFMEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:29:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I5NTEnFDsMMDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-13 08:30:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:51096: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-13 08:30:32 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:58172: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:30:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9nuqFXFDJqwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:31:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nC3bGXFDsNQDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:32:09 host2 sshd[2460637]: Disconnected from invalid user sonar 103.52.37.10 port 5725 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:32:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<8yKeHXFDJLoDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:32:58 host2 sshd[2461197]: Disconnected from invalid user adrian 186.103.169.12 port 55270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:34:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<g1seJHFDDq0Dg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:34:45 host2 sshd[2462368]: Disconnected from invalid user radio 186.103.169.12 port 46846 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:36:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<i7rJK3FDPOEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:38:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UMl8MnFDRqkDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 08:39:55 host2 sshd[2466022]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:39:51 host2 sshd[2465999]: Disconnected from invalid user user1 186.103.169.12 port 60244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-13 08:41:54 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (cphidding) [73.213.237.28]:33770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 13 08:42:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<+00xP3FDMvzG6xil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.155
country_id: 6252001
description:
Nov 13 08:42:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.106.155, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aFP2P3FD3tgUQGqb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:43:18 host2 sshd[2467854]: Disconnected from invalid user testuser 186.103.169.12 port 54196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-11-13 08:43:30 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:40888: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.217
country_id: 798544
description:
2025-11-13 08:43:02 dovecot_login authenticator failed for (ADMIN) [138.199.59.217]:38330: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-13 08:43:49 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:39518: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:44:47 host2 sshd[2469135]: Disconnected from invalid user aura 103.52.37.10 port 43291 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-13 08:45:22 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:36076: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-13 08:46:23 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:51118: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-13 08:46:40 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:48108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.177.206
country_id: 6252001
description:
Nov 13 08:50:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.67.177.206, lip=66.85.158.91, session=<2RZ+W3FDMOYoQ7HO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-13 08:50:16 dovecot_plain authenticator failed for (unsis) [80.227.102.242]:46715: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.66.41.91
country_id: 3469034
description:
Nov 13 08:52:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.66.41.91, lip=66.85.158.91, TLS, session=<rniPZHFDhLixQilb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.32
country_id: 3469034
description:
Nov 13 08:53:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=186.209.249.32, lip=66.85.158.91, TLS, session=<HBrgZXFDN8m60fkg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 08:55:28 host2 sshd[2478726]: Disconnected from invalid user user1 102.140.97.134 port 44278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.168.70
country_id: 6252001
description:
2025-11-13 08:59:44 dovecot_login authenticator failed for c-73-21-168-70.hsd1.fl.comcast.net [73.21.168.70]:48950: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-13 08:59:56 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:56148: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 09:00:22 host2 sshd[2482075]: Disconnected from invalid user user 102.140.97.134 port 49016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-13 09:00:32 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:55202: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.254
country_id: 6252001
description:
Nov 13 09:03:03 host2 pure-ftpd[2483739]: (?@198.235.24.254) [INFO] New connection from 198.235.24.254


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.83.104
country_id: 6252001
description:
Nov 13 09:04:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.83.104, lip=66.85.158.92, session=<cA6NjXFD9IasslNo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-11-13 09:05:25 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:35981: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.198
country_id: 2635167
description:
2025-11-13 09:05:35 dovecot_login authenticator failed for (ADMIN) [98.159.234.198]:40025: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.145
country_id: 2186224
description:
2025-11-13 09:05:40 dovecot_login authenticator failed for ([121.73.162.145]) [121.73.162.145]:49078: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.93.21
country_id: 2510769
description:
Nov 13 09:06:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.143.93.21, lip=66.85.158.91, TLS, session=<euHSk3FDMrS5j10V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.31
country_id: 953987
description:
Nov 13 09:06:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.79.19.31, lip=66.85.158.91, TLS, session=<WyEelXFDvZMpTxMf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:08:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<umARnXFDGdai2Ja4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:09:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<+kuEoHFDHOGi2Ja4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.218
country_id: 953987
description:
Nov 13 09:13:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.34.218, lip=66.85.158.91, TLS, session=<wTChrXFDdq1mQCLa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.89.211.101
country_id: 3469034
description:
Nov 13 09:13:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=189.89.211.101, lip=66.85.158.91, TLS, session=<2cHornFDGty9WdNl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:15:14 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS, session=<pdZvtXFDKu2i2Ja4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-13 09:15:54 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:35720: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 13 09:16:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<I3xtuHFDBqNChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-13 09:16:21 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:51066: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-13 09:17:00 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:47400: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:17:57 host2 sshd[2494087]: Disconnected from invalid user vaibhav 81.215.228.18 port 35948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-13 09:17:25 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:38992: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-13 09:18:49 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:64605: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-13 09:18:40 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:59643: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:21:15 host2 sshd[2496107]: Disconnected from invalid user splunk 81.215.228.18 port 59706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:23:49 host2 sshd[2497684]: Disconnected from invalid user mcserver 81.215.228.18 port 60736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-11-13 09:24:55 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:45106: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.65
country_id: 390903
description:
2025-11-13 09:24:39 dovecot_login authenticator failed for (ADMIN) [79.127.181.65]:57785: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-13 09:25:20 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:52891: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 09:26:08 host2 sshd[2499019]: Disconnected from invalid user admin 2.57.121.112 port 9674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:26:10 host2 sshd[2499047]: Disconnected from invalid user dominic 81.215.228.18 port 33510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:27:18 host2 sshd[2500024]: Disconnected from invalid user erp 81.215.228.18 port 33996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-11-13 09:27:24 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:37645: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-11-13 09:27:39 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:52416: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov 13 09:29:51 host2 sshd[2501519]: Disconnected from invalid user jamshid 102.214.200.110 port 40926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov 13 09:32:51 host2 sshd[2503496]: Disconnected from invalid user super 102.214.200.110 port 60112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 09:33:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57117: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.40.150
country_id: 3469034
description:
Nov 13 09:34:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=189.127.40.150, lip=66.85.158.91, TLS, session=<KQ7V+XFDutq9fyiW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.28
country_id: 3865483
description:
Nov 13 09:35:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=190.181.97.28, lip=66.85.158.91, TLS, session=<SV8K+3FDwt++tWEc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 09:40:51 host2 sshd[2508248]: Disconnected from invalid user 1234 2.57.121.112 port 62836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 09:45:43 host2 sshd[2512404]: Disconnected from invalid user nadine 62.60.131.157 port 24480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.106.171
country_id: 6252001
description:
2025-11-13 09:46:07 dovecot_login authenticator failed for (ADMIN) [191.96.106.171]:48556: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 09:47:12 host2 sshd[2513868]: Disconnected from invalid user shiny 101.47.49.206 port 45694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.154.22
country_id: 298795
description:
2025-11-13 09:52:50 dovecot_plain authenticator failed for (oblen) [5.26.154.22]:55312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 09:53:51 host2 sshd[2518030]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.124.119
country_id: 2802361
description:
Nov 13 09:54:32 host2 pure-ftpd[2518982]: (?@34.140.124.119) [INFO] New connection from 34.140.124.119


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.69
country_id: 690791
description:
Nov 13 09:54:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.17.124.69, lip=66.85.158.91, TLS, session=<tXkCQXJDosO5EXxF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.121.76.169
country_id: 732800
description:
Nov 13 09:54:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=87.121.76.169, lip=66.85.158.91, TLS, session=<WEcRQnJDY+tXeUyp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 13 09:56:31 host2 pure-ftpd[2520389]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-13 10:04:05 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:39000: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-13 10:03:48 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:41252: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.109
country_id: 6252001
description:
2025-11-13 10:04:39 dovecot_login authenticator failed for (ADMIN) [102.129.152.109]:53326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.153
country_id: 3017382
description:
Nov 13 10:04:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.153, lip=66.85.158.92, session=<yzNFZ3JDM75bxJiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.157
country_id: 3017382
description:
Nov 13 10:05:25 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.157, lip=66.85.158.92, session=<u9rgaHJDuYFbxJid>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.158
country_id: 3017382
description:
Nov 13 10:05:28 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.158, lip=66.85.158.92, session=<DxgTaXJDx+FbxJie>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 10:06:54 host2 sshd[2527948]: Disconnected from invalid user amine 101.47.49.206 port 45030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-11-13 10:07:24 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:52209: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-13 10:07:43 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:43148: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 10:12:04 host2 sshd[2531363]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 10:16:49 host2 sshd[2534592]: Disconnected from invalid user ceshi 101.47.49.206 port 39418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-13 10:18:05 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (comai) [76.145.10.140]:60104: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-13 10:20:32 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:36496: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-13 10:20:44 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:60200: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.206.145
country_id: 2750405
description:
2025-11-13 10:24:39 dovecot_login authenticator failed for (ADMIN) [181.214.206.145]:20449: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-13 10:26:08 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47701: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-11-13 10:26:19 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:46888: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-13 10:26:37 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:46658: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 199.91.162.55
country_id: 3570311
description:
Nov 13 10:29:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=199.91.162.55, lip=66.85.158.91, TLS, session=<FD3IvXJD4pfHW6I3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.68.23
country_id: 1269750
description:
Nov 13 10:29:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=103.56.68.23, lip=66.85.158.91, TLS, session=<76H2vnJDeqdnOEQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:33:48 host2 sshd[2546579]: Disconnected from invalid user seekcy 103.137.194.125 port 54884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-13 10:33:34 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (worihus) [73.224.171.101]:40894: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.48
country_id: 6252001
description:
Nov 13 10:35:13 host2 pure-ftpd[2547746]: (?@167.94.146.48) [INFO] New connection from 167.94.146.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-13 10:36:24 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:35072: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:37:56 host2 sshd[2549507]: Disconnected from invalid user matias 103.137.194.125 port 43258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-13 10:39:18 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41452: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:39:16 host2 sshd[2550348]: Disconnected from invalid user jak 103.137.194.125 port 45730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-13 10:38:53 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:44463: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-11-13 10:39:09 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:48600: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-13 10:39:29 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:34446: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-13 10:41:24 dovecot_login authenticator failed for (Xsx49XK) [178.16.54.32]:62453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:41:58 host2 sshd[2552500]: Disconnected from invalid user getosindex 103.137.194.125 port 60322 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.239
country_id: 6252001
description:
Nov 13 10:43:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.239, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Z+z58XJDaN/G6xjv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-13 10:43:21 dovecot_login authenticator failed for (IkuMQgI) [178.16.54.32]:53304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:44:38 host2 sshd[2553977]: Disconnected from invalid user agent 103.137.194.125 port 54120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-13 10:45:04 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:41916: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-13 10:44:20 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:56653: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-13 10:44:36 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:33386: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.155
country_id: 2328926
description:
2025-11-13 10:47:12 dovecot_login authenticator failed for (ADMIN) [146.70.65.155]:53686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 10:48:19 host2 sshd[2556902]: Disconnected from invalid user user 2.57.121.25 port 33304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 13 10:48:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<zkczBHNDjtCLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.134
country_id: 3469034
description:
Nov 13 10:49:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.131.134, lip=66.85.158.91, TLS, session=<L00bBXNDidW/NYOG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.209
country_id: 3865483
description:
Nov 13 10:49:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=186.190.167.209, lip=66.85.158.91, TLS, session=<WF1bBnNDlau6vqfR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-13 10:56:40 dovecot_plain authenticator failed for (preming) [65.20.186.177]:47992: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.111
country_id: 2661886
description:
2025-11-13 11:02:28 dovecot_login authenticator failed for (ADMIN) [212.112.19.111]:10690: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.99.148.146
country_id: 6252001
description:
2025-11-13 11:05:40 dovecot_login authenticator failed for (ool-4b639492.static.optonline.net) [75.99.148.146]:39784: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-13 11:05:53 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:24664: 535 Incorrect authentication data (set_id=test)


