# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-21 20:45:38 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (blarmen) [24.15.216.41]:53794: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.12
country_id: 6252001
description:
Dec 21 20:49:04 host2 pure-ftpd[2622260]: (?@205.210.31.12) [INFO] New connection from 205.210.31.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.145
country_id: 3175395
description:
Dec 21 20:50:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.171.145, lip=66.85.158.91, TLS, session=<4mWx13dGo9G5D6uR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.27.237
country_id: 3469034
description:
Dec 21 20:50:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.152.27.237, lip=66.85.158.91, TLS, session=<6fze2HdGnaKxmBvt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-12-21 20:55:19 dovecot_login authenticator failed for H=([178.158.235.131]) [178.158.235.131]:56030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 20:57:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Yc228ndGrMGi2JZ6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 20:58:21 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<CXDu9XdGrvei2JZ6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 21 20:59:03 host2 sshd[2632666]: Disconnected from invalid user tmp 146.59.95.254 port 40824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 21 21:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.92, session=<30ETB3hG1JZV2ZUJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 21:02:49 host2 pure-ftpd[2636258]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 21 21:04:14 host2 sshd[2637539]: Disconnected from invalid user opc 146.59.95.254 port 56038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 21:05:20 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS, session=<xVTsDnhGROii2JZ6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:07:13 host2 sshd[2640452]: Disconnected from invalid user builder 203.90.110.186 port 38424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:09:19 host2 sshd[2642444]: Disconnected from invalid user test3 203.90.110.186 port 54094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:11:24 host2 sshd[2645184]: Disconnected from invalid user odoo 203.90.110.186 port 54442 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.196.109
country_id: 6252001
description:
[2025-12-21 21:17:01 +0530] info [cpaneld] 74.141.196.109 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.56.92.46
country_id: 6252001
description:
[2025-12-21 21:17:04 +0530] info [cpaneld] 173.56.92.46 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.43.244
country_id: 6252001
description:
[2025-12-21 21:16:54 +0530] info [cpaneld] 24.217.43.244 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.203.165
country_id: 6252001
description:
[2025-12-21 21:16:55 +0530] info [cpaneld] 38.44.203.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.27.130.29
country_id: 6252001
description:
[2025-12-21 21:16:57 +0530] info [cpaneld] 38.27.130.29 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.193.26.210
country_id: 6252001
description:
[2025-12-21 21:17:00 +0530] info [whostmgrd] 73.193.26.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.172
country_id: 6252001
description:
[2025-12-21 21:17:02 +0530] info [cpaneld] 172.58.167.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 21 21:19:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<gJdyQXhG8lmnXpI6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 21 21:19:29 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, session=<e2eKQXhG/FmnXpI6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 21 21:24:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<THidU3hG2LBChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-21 21:29:09 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:60148: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-21 21:29:25 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:44923: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 21:31:22 host2 sshd[2664372]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:33:12 host2 sshd[2666071]: Disconnected from invalid user ubuntu 51.158.146.24 port 52974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Dec 21 21:34:13 host2 sshd[2666780]: Disconnected from invalid user user1 196.28.242.198 port 39624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:34:17 host2 sshd[2666850]: Disconnected from invalid user sftpuser1 51.158.146.24 port 41076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:34:25 host2 sshd[2666918]: Disconnected from invalid user sftpuser1 93.93.116.246 port 52858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:34:52 host2 sshd[2667221]: Disconnected from invalid user user1 51.158.146.24 port 59488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:37:49 host2 sshd[2669811]: Disconnected from invalid user app 93.93.116.246 port 42434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:39:12 host2 sshd[2670850]: Disconnected from invalid user admin 93.93.116.246 port 45880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Dec 21 21:39:38 host2 sshd[2671279]: Disconnected from invalid user sftpuser1 196.28.242.198 port 47132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:39:51 host2 sshd[2671453]: Disconnected from invalid user elsearch 93.93.116.246 port 54222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-21 21:46:13 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:36460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-21 21:46:41 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [116.72.9.151]:44604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Dec 21 21:50:50 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.94, lip=66.85.158.91, TLS, session=<w6qgsXhGiCAtT7Ve>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Dec 21 21:50:58 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YWsjsnhGaP2saAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:51:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dpxOs3hGZtOi2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:51:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<W79RtXhGZOii2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:59:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS, session=<ktB4z3hGjPqi2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.78
country_id: 6252001
description:
Dec 21 22:02:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.78, lip=66.85.158.91, session=<LKLb23hGxocUQcFO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-21 22:04:37 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:54374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:05:18 host2 sshd[2711552]: Disconnected from invalid user test 83.168.69.143 port 55834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 21 22:05:19 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.232.188.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3g5r5XhGwIys6Lyx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-21 22:06:19 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:53655: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:05:41 host2 sshd[2711901]: Disconnected from invalid user ramesh 139.59.64.179 port 39612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 22:05:43 host2 pure-ftpd[2711934]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-21 22:08:07 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:52962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:08:20 host2 sshd[2713990]: Disconnected from invalid user oneadmin 139.59.64.179 port 54922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-21 22:08:25 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:47448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:07:43 host2 sshd[2713497]: Disconnected from invalid user developer 139.59.64.179 port 43110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:10:20 host2 sshd[2715972]: Disconnected from invalid user ionadmin 83.168.69.143 port 34168 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 22:11:11 host2 sshd[2716693]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:10:53 host2 sshd[2716424]: Disconnected from invalid user alex 83.168.69.143 port 52792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:11:25 host2 sshd[2716881]: Disconnected from invalid user app 83.168.69.143 port 54158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.214
country_id: 6252001
description:
Dec 21 22:11:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.214, lip=66.85.158.92, session=<mSgd/XhGSpIUQcDW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.219
country_id: 1269750
description:
Dec 21 22:17:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.104.127.219, lip=66.85.158.91, TLS, session=<SPuzDnlGbq1naH/b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.143.228.155
country_id: 6252001
description:
Dec 21 22:16:49 host2 sshd[2722031]: Invalid user cloudtourssrilan_travel from 185.143.228.155 port 64332


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.1
country_id: 953987
description:
Dec 21 22:16:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.129.50.1, lip=66.85.158.91, TLS, session=<EDNiDXlGhtFmgTIB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-21 22:19:10 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60645: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.144
country_id: 6252001
description:
Dec 21 22:19:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SxcQF3lG38lAPsWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 21 22:19:30 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lbIiGHlG8lFAPsWJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-12-21 22:19:34 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:38974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 21 22:21:13 host2 pure-ftpd[2725802]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-21 22:21:39 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:60266: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.91
country_id: 3175395
description:
Dec 21 22:21:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.91, lip=66.85.158.91, TLS, session=<JBfpHnlG3s65D6lb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.131
country_id: 3175395
description:
Dec 21 22:22:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=185.15.169.131, lip=66.85.158.91, TLS, session=<2WsBIHlGgLm5D6mD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-21 22:22:31 dovecot_login authenticator failed for H=(201.173.250.136-clientes-izzi.mx) [201.173.250.136]:39161: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.224.244
country_id: 2921044
description:
Dec 21 22:25:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.224.244, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<TcS1LXlGkU+G0eD0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.166.74
country_id: 2921044
description:
Dec 21 22:26:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.166.74, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xmzjL3lGvhykWqZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Dec 21 22:29:27 host2 sshd[2733241]: Disconnected from invalid user amit 170.254.229.191 port 54994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:31:00 host2 sshd[2734748]: Disconnected from invalid user smbguest 154.198.215.66 port 41300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 21 22:31:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS: Connection closed, session=<qujDQXlGFvpChJmM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:31:37 host2 sshd[2735340]: Disconnected from invalid user nodejs 154.198.215.66 port 53578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-12-21 22:32:08 dovecot_login authenticator failed for H=([74.95.13.185]) [74.95.13.185]:58882: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 21 22:33:11 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, session=<HUoRSXlGTAhChJl2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-21 22:32:29 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45070: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:32:51 host2 sshd[2736311]: Disconnected from invalid user infra 154.198.215.66 port 49868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.17
country_id: 3175395
description:
Dec 21 22:34:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=185.15.171.17, lip=66.85.158.91, TLS, session=<1HUhS3lGLqO5D6sR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.85
country_id: 732800
description:
Dec 21 22:34:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=185.253.159.85, lip=66.85.158.91, TLS, session=<6FImTHlGCLO5/Z9V>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Dec 21 22:33:31 host2 sshd[2736890]: Disconnected from invalid user katja 170.254.229.191 port 43382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.212.90
country_id: 933860
description:
Dec 21 22:33:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=41.216.212.90, lip=66.85.158.91, TLS, session=<apOsSXlGRaQp2NRa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.226
country_id: 3865483
description:
Dec 21 22:34:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=179.0.250.226, lip=66.85.158.91, TLS, session=<gLrnSnlG3LazAPri>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-21 22:34:45 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (eptic) [73.183.74.177]:57666: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.221
country_id: 3017382
description:
Dec 21 22:43:27 host2 sshd[2746023]: Invalid user secondcoffeeinternational from 37.59.110.221 port 35896


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-21 22:45:47 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:45278: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-12-21 22:46:18 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:60582: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-21 22:46:48 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:52254: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-21 22:48:26 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:37052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-21 22:48:49 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:54830: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-21 22:49:28 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:48352: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-21 22:53:15 dovecot_login authenticator failed for H=([125.19.169.115]) [128.185.235.110]:34390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-21 22:54:35 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:56492: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 22:55:41 host2 sshd[2757820]: Disconnected from invalid user livetest 159.223.8.81 port 42718 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Dec 21 22:57:51 host2 pure-ftpd[2759767]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 22:58:57 host2 sshd[2760770]: Disconnected from invalid user user01 159.223.8.81 port 57216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 23:00:03 host2 sshd[2761825]: Disconnected from invalid user guest 159.223.8.81 port 53718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-21 23:01:10 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:47576: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.97.183
country_id: 3077311
description:
Dec 21 23:01:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.98.97.183, lip=66.85.158.91, TLS, session=<APxjrHlGbMSwYmG3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 23:00:37 host2 sshd[2762382]: Disconnected from invalid user ftest 159.223.8.81 port 44072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-21 23:01:26 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:54550: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.72.200.48
country_id: 3077311
description:
Dec 21 23:01:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=178.72.200.48, lip=66.85.158.91, TLS, session=<jiVwrXlGGt+ySMgw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-21 23:01:57 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:45740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-12-21 23:02:20 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:54491: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 23:08:28 host2 pure-ftpd[2769004]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-21 23:11:18 dovecot_login authenticator failed for H=([182.73.109.194]) [182.73.109.194]:60120: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2025-12-21 23:10:57 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:40138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-21 23:11:46 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:47735: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-21 23:13:47 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3735: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-21 23:14:14 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:38581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-21 23:14:36 dovecot_login authenticator failed for H=([182.95.178.122]) [182.95.178.122]:54050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 23:21:14 host2 sshd[2779960]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Dec 21 23:31:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8rC0GHpGKrRBMRRF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-21 23:30:34 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:44666: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-21 23:30:53 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:38362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Dec 21 23:31:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<H+b5GXpGbINBMRRF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 23:34:58 host2 sshd[2791114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.138
country_id: 798544
description:
Dec 21 23:35:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.246.209.138, lip=66.85.158.91, TLS, session=<5qlMJXpGq6xb9tGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.134
country_id: 6290252
description:
Dec 21 23:34:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.206.98.134, lip=66.85.158.91, TLS, session=<55E0JHpG09NtzmKG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.224.207
country_id: 6252001
description:
Dec 21 23:37:03 host2 pure-ftpd[2792887]: (?@20.15.224.207) [INFO] New connection from 20.15.224.207


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:37:50 host2 sshd[2793432]: Disconnected from invalid user amir 155.4.244.169 port 23101 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:39:06 host2 sshd[2794539]: Disconnected from invalid user cuckoo 155.4.244.169 port 19061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:40:27 host2 sshd[2795707]: Disconnected from invalid user amir 158.69.194.34 port 60086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:40:53 host2 sshd[2795993]: Disconnected from invalid user liwei 155.4.244.169 port 43859 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-21 23:42:03 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:40690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:42:10 host2 sshd[2796881]: Disconnected from invalid user hari 158.69.194.34 port 56450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-21 23:41:23 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:36541: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:42:37 host2 sshd[2797215]: Disconnected from invalid user ubuntu 155.4.244.169 port 3342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 21 23:42:38 host2 sshd[2797261]: Disconnected from invalid user lucas 209.141.47.217 port 48686 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 21 23:43:10 host2 sshd[2797777]: Disconnected from invalid user ahmet 209.141.47.217 port 59464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:43:47 host2 sshd[2798201]: Disconnected from invalid user main 158.69.194.34 port 57012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.194
country_id: 6252001
description:
Dec 21 23:43:53 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.194, lip=66.85.158.91, session=<P2nxRXpGT6dBMQHC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Dec 21 23:44:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS: Connection closed, session=<p96vRnpGnpxBMQHA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:45:20 host2 sshd[2800254]: Disconnected from invalid user liwei 141.147.62.42 port 57144 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:45:26 host2 sshd[2800367]: Received disconnect from 158.69.194.34 port 34454:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:45:26 host2 sshd[2800367]: Disconnected from invalid user devops 158.69.194.34 port 34454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:54:01 host2 sshd[2807004]: Disconnected from invalid user Rizve 141.147.62.42 port 45778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:58:24 host2 sshd[2811118]: Disconnected from invalid user lucas 141.147.62.42 port 37592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-21 23:59:49 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:33310: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-22 00:00:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:49842: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 00:00:25 host2 sshd[2812972]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 22 00:02:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<KlEPiXpGYJqLonHU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:02:46 host2 sshd[2814882]: Disconnected from invalid user ahmet 141.147.62.42 port 59776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.119
country_id: 3175395
description:
Dec 22 00:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.197.8.119, lip=66.85.158.91, TLS, session=<r03HiXpGaI25xQh3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.98
country_id: 690791
description:
Dec 22 00:03:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=194.44.140.98, lip=66.85.158.91, TLS, session=<QfHYinpGhbzCLIxi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 00:06:23 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:38308: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:08:17 host2 sshd[2819621]: Disconnected from invalid user devops 141.147.62.42 port 43484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 00:09:25 host2 sshd[2820509]: Disconnected from invalid user admin 2.57.121.112 port 51776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 22 00:10:41 host2 sshd[2821827]: Disconnected from invalid user bo 40.115.18.231 port 43838 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 00:11:03 host2 pure-ftpd[2822339]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:14:12 host2 sshd[2825420]: Disconnected from invalid user uno50 41.111.162.34 port 14948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 22 00:14:45 host2 sshd[2825933]: Disconnected from invalid user postgres 40.115.18.231 port 55584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:14:52 host2 sshd[2826056]: Disconnected from invalid user erfan 141.147.62.42 port 35072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-22 00:16:21 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:39706: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 00:15:47 host2 sshd[2827148]: Disconnected from invalid user user 2.57.121.25 port 43434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-22 00:16:33 dovecot_login authenticator failed for H=(201.173.250.42-clientes-izzi.mx) [201.173.250.42]:41240: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 00:18:20 host2 sshd[2829317]: Disconnected from invalid user syed 62.60.131.157 port 12775 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:19:04 host2 sshd[2829883]: Disconnected from invalid user ubuntu 41.111.162.34 port 18584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:20:53 host2 sshd[2831810]: Disconnected from invalid user django 41.111.162.34 port 1649 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 22 00:23:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+ceZ0npGfIHY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 22 00:23:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZO7Y03pGJPXY2s5E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.103.85
country_id: 3469034
description:
Dec 22 00:23:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.224.103.85, lip=66.85.158.91, TLS, session=<bAta03pGLba64GdV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.60.116
country_id: 798544
description:
Dec 22 00:24:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=91.231.60.116, lip=66.85.158.91, TLS, session=<Wwh41HpGU45b5zx0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.185.118
country_id: 6252001
description:
Dec 22 00:29:47 host2 pure-ftpd[2840147]: (?@44.220.185.118) [INFO] New connection from 44.220.185.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-22 00:31:22 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:43476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-22 00:31:50 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:55588: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.189
country_id: 6252001
description:
Dec 22 00:35:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.189, lip=66.85.158.92, session=<v2bP/3pGvUJAPpy9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Dec 22 00:36:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS: Connection closed, session=<s9eYAHtGHBhAPpy2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-22 00:36:51 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:59526: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-22 00:36:38 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:58446: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-22 00:40:47 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:48508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:40:50 host2 sshd[2850312]: Disconnected from invalid user csgoserver 103.13.206.142 port 56952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-22 00:41:07 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:48010: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 22 00:41:16 host2 sshd[2850621]: Disconnected from invalid user db2inst1 103.88.76.27 port 59234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:41:35 host2 sshd[2850836]: Disconnected from invalid user dalia 103.13.206.142 port 38956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.112.2
country_id: 149590
description:
2025-12-22 00:42:09 dovecot_login authenticator failed for H=([41.93.112.2]) [41.93.112.2]:51164: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-22 00:42:53 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:32908: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:43:00 host2 sshd[2851823]: Disconnected from invalid user ubuntu 103.13.206.142 port 50752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 22 00:45:55 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.57, lip=66.85.158.92, TLS, session=</gTOI3tGKPvN0h85>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.234
country_id: 6252001
description:
Dec 22 00:52:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.234, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zL3FOXtG7srN0h/q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.221
country_id: 3017382
description:
Dec 22 00:53:15 host2 sshd[2859996]: Invalid user secondcoffeeinternational from 37.59.110.221 port 49048


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 94.102.49.155
country_id: 2750405
description:
Dec 22 00:56:06 host2 pure-ftpd[2862477]: (?@94.102.49.155) [INFO] New connection from 94.102.49.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.224.18.139
country_id: 6252001
description:
2025-12-22 00:57:02 dovecot_plain authenticator failed for H=ec2-54-224-18-139.compute-1.amazonaws.com (EC2AMAZ-7E395FK.ec2.internal) [54.224.18.139]:55363: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.34
country_id: 3077311
description:
Dec 22 01:04:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=217.75.222.34, lip=66.85.158.91, TLS, session=<tguXZHtG6N/ZS94i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.90
country_id: 298795
description:
Dec 22 01:04:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.90, lip=66.85.158.91, TLS, session=<rwDDZXtGPZRfACBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:08:53 host2 sshd[2872697]: Disconnected from invalid user gitlab-runner 172.245.208.136 port 53860 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 01:09:39 host2 sshd[2873046]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:10:00 host2 sshd[2873251]: Disconnected from invalid user salma 172.245.208.136 port 59980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:10:31 host2 sshd[2873839]: Disconnected from invalid user cma 172.245.208.136 port 54244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-22 01:10:53 dovecot_login authenticator failed for H=([127.0.0.1]) [151.76.55.177]:39154: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2025-12-22 01:11:00 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net ([127.0.0.1]) [70.166.137.91]:40376: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:13:12 host2 sshd[2876030]: Received disconnect from 172.245.208.136 port 54172:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:13:12 host2 sshd[2876030]: Disconnected from invalid user new 172.245.208.136 port 54172 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 01:13:24 host2 pure-ftpd[2876151]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-22 01:20:48 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:52040: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.91.230
country_id: 3865483
description:
Dec 22 01:30:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=190.181.91.230, lip=66.85.158.91, TLS, session=<z+YgwXtGuJS+tVvm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 94.102.49.155
country_id: 2750405
description:
Dec 22 01:29:27 host2 pure-ftpd[2888986]: (?@94.102.49.155) [INFO] New connection from 94.102.49.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.217.112.99
country_id: 798544
description:
Dec 22 01:29:51 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=178.217.112.99, lip=66.85.158.91, TLS, session=<u7Prv3tGL6+y2XBj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.133.80
country_id: 1643084
description:
[2025-12-22 01:33:20 +0530] info [whostmgrd] 103.94.133.80 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 22 01:33:21 host2 sshd[2892376]: Invalid user info@idesignvector.com from 103.94.133.80 port 53162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 01:32:26 host2 sshd[2891539]: Disconnected from invalid user dexter 62.60.131.157 port 12754 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 22 01:33:20 host2 pure-ftpd[2892379]: (?@103.94.133.80) [INFO] New connection from 103.94.133.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.191.6
country_id: 6252001
description:
[2025-12-22 01:33:36 +0530] info [whostmgrd] 143.105.191.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.221.60.108
country_id: 6252001
description:
Dec 22 01:34:28 host2 pure-ftpd[2893322]: (?@20.221.60.108) [INFO] New connection from 20.221.60.108


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 22 01:38:11 host2 sshd[2896329]: Disconnected from invalid user sammy 103.171.85.219 port 45954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-22 01:39:05 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (retthory) [73.137.7.97]:54090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.148.30
country_id: 3175395
description:
Dec 22 01:40:20 host2 sshd[2898091]: Disconnected from invalid user db2fenc 151.43.148.30 port 8677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 22 01:39:38 host2 sshd[2897403]: Disconnected from invalid user email 103.171.85.219 port 38648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 22 01:39:40 host2 sshd[2897434]: Disconnected from invalid user db2inst1 64.23.180.137 port 34554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 22 01:40:44 host2 sshd[2898527]: Disconnected from invalid user cosmos 64.23.180.137 port 54488 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.93
country_id: 6252001
description:
Dec 22 01:43:58 host2 pure-ftpd[2900997]: (?@147.185.132.93) [INFO] New connection from 147.185.132.93


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-12-22 01:45:02 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:37508: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-22 01:45:26 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:45254: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-22 01:47:19 dovecot_login authenticator failed for H=89-67-37-2.dynamic.play.pl [89.67.37.2]:43318: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-22 01:47:42 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:39041: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.148.30
country_id: 3175395
description:
Dec 22 01:47:33 host2 sshd[2904280]: Disconnected from invalid user irfan 151.43.148.30 port 8336 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 01:48:36 host2 sshd[2905083]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.186.240
country_id: 1819730
description:
Dec 22 01:54:58 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.186.240, lip=66.85.158.92, session=<7t+1GnxG0JqYILrw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.186.240
country_id: 1819730
description:
Dec 22 01:54:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.186.240, lip=66.85.158.92, session=<pcaiGnxGzpmYILrw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-22 01:56:17 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:53039: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-22 01:56:57 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:58974: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-22 02:04:59 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:50082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-22 02:05:23 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:36818: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-12-22 02:08:17 dovecot_login authenticator failed for H=([63.65.203.86]) [63.65.203.86]:60367: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-22 02:08:40 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3918: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 02:08:59 host2 sshd[2924582]: Disconnected from invalid user abigale 62.60.131.157 port 16553 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.69.91
country_id: 2921044
description:
Dec 22 02:10:41 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.69.91, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<ewbrUnxGfyqlFkVb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-22 02:10:53 dovecot_login authenticator failed for H=(78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:57914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.119.148
country_id: 2921044
description:
Dec 22 02:11:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.119.148, lip=66.85.158.92, TLS handshaking: Connection closed, session=<orYIVXxGoiCl6HeU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.78.157
country_id: 3996063
description:
Dec 22 02:11:55 host2 sshd[2927288]: Disconnected from invalid user oracle 189.178.78.157 port 56022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.141
country_id: 6252001
description:
Dec 22 02:14:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.15.141, lip=66.85.158.92, TLS, session=<ZLj/X3xGUrAUow+N>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 02:15:48 host2 pure-ftpd[2930782]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.33
country_id: 6252001
description:
Dec 22 02:16:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.15.225.33, lip=66.85.158.91, TLS, session=<2Y/CZnxGaroUD+Eh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-22 02:17:51 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:58522: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-12-22 02:20:13 dovecot_login authenticator failed for H=([188.59.6.176]) [188.59.6.176]:53786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-22 02:21:07 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:33186: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-22 02:20:47 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:41806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 02:26:04 host2 sshd[2939044]: Disconnected from invalid user admin 2.57.121.112 port 20561 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-22 02:28:20 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:34714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-22 02:28:49 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:34650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-22 02:29:04 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:46699: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-22 02:31:32 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:4921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-22 02:32:01 dovecot_login authenticator failed for H=([125.19.196.207]) [27.123.104.142]:51386: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.16
country_id: 6252001
description:
Dec 22 02:34:37 host2 pure-ftpd[2946103]: (?@147.185.132.16) [INFO] New connection from 147.185.132.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:36:17 host2 sshd[2947756]: Disconnected from invalid user sysadmin 103.139.192.221 port 60970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 02:36:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<ckOer3xGPObBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:36:50 host2 sshd[2948138]: Disconnected from invalid user t128 199.195.248.191 port 56106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:38:31 host2 sshd[2949381]: Disconnected from invalid user teste2 199.195.248.191 port 37496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 22 02:38:43 host2 sshd[2949524]: Disconnected from invalid user bitnami 198.23.143.193 port 40020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 22 02:39:52 host2 sshd[2950484]: Disconnected from invalid user developer 198.23.143.193 port 39096 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:41:45 host2 sshd[2952299]: Received disconnect from 199.195.248.191 port 56732:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:41:48 host2 sshd[2952325]: Disconnected from invalid user pepe 177.85.247.230 port 25244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:42:18 host2 sshd[2952657]: Disconnected from invalid user test1 199.195.248.191 port 41118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:42:59 host2 sshd[2953093]: Disconnected from invalid user mario 177.85.247.230 port 7844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:43:31 host2 sshd[2953599]: Disconnected from invalid user sign 177.85.247.230 port 28010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.119
country_id: 1643084
description:
Dec 22 02:44:40 host2 sshd[2954407]: Disconnected from invalid user alpha 103.23.199.119 port 56926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:47:52 host2 sshd[2957678]: Disconnected from invalid user teste2 103.139.192.221 port 47474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:48:41 host2 sshd[2958285]: Disconnected from invalid user markus 103.139.192.221 port 33036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-12-22 02:51:19 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:60890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:51:03 host2 sshd[2960284]: Disconnected from invalid user root1 103.139.192.221 port 46194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-22 02:51:45 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:42038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.193
country_id: 6252001
description:
Dec 22 02:53:58 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.193, lip=66.85.158.91, session=<Zwq27XxG9Nes7OTB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 02:57:31 host2 sshd[2965543]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 02:59:17 host2 sshd[2966668]: Disconnected from invalid user admin 2.57.121.112 port 12793 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.99.94
country_id: 3996063
description:
Dec 22 02:58:41 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=138.122.99.94, lip=66.85.158.91, TLS, session=<RaOW/XxG++OKemNe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.5
country_id: 798544
description:
Dec 22 02:59:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=77.65.142.5, lip=66.85.158.91, TLS, session=<qrOt/nxGOsBNQY4F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.81.30.149
country_id: 2921044
description:
Dec 22 02:59:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.81.30.149, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<JGiXAn1GBUHOUR6V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.206.154
country_id: 2921044
description:
Dec 22 03:00:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.206.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DeGxBH1GvIMuZc6a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-22 03:06:21 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:54313: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-12-22 03:06:35 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:52646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-22 03:14:49 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:52934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 03:15:10 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:58068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:16:27 host2 sshd[2979681]: Disconnected from invalid user doc 187.51.208.158 port 40331 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:16:53 host2 sshd[2980043]: Disconnected from invalid user dan 157.20.207.165 port 57248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:17:06 host2 sshd[2980266]: Disconnected from invalid user ansible 83.229.122.23 port 50902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:17:25 host2 sshd[2980522]: Disconnected from invalid user ansible 187.51.208.158 port 48580 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 03:17:48 host2 pure-ftpd[2980836]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Dec 22 03:18:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<gihan>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<JuDDQn1GTLmzAPqa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.105.219.200
country_id: 690791
description:
Dec 22 03:17:33 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.105.219.200, lip=66.85.158.91, TLS, session=<qHgPQX1GRsywadvI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:19:01 host2 sshd[2981722]: Disconnected from invalid user dan 83.229.122.23 port 52998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:20:19 host2 sshd[2982797]: Disconnected from invalid user dan 187.51.208.158 port 47892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Dec 22 03:19:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.117, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7FgWSX1GV92TuYR1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:21:08 host2 sshd[2983400]: Disconnected from invalid user hari 157.20.207.165 port 38712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 03:21:26 host2 sshd[2983718]: Disconnected from invalid user abagail 62.60.131.157 port 36186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:21:42 host2 sshd[2983888]: Disconnected from invalid user hari 187.51.208.158 port 33429 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-22 03:22:39 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:42306: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2025-12-22 03:22:58 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:41082: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:22:57 host2 sshd[2984674]: Disconnected from invalid user flussonic 83.229.122.23 port 58314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:23:01 host2 sshd[2984725]: Disconnected from invalid user qq 157.20.207.165 port 41746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:25:20 host2 sshd[2986535]: Disconnected from invalid user doc 157.20.207.165 port 59044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2025-12-22 03:27:59 dovecot_login authenticator failed for H=([49.124.151.63]) [49.124.151.63]:54660: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-22 03:28:22 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:50201: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 03:30:23 host2 sshd[2990771]: Disconnected from invalid user user 2.57.121.25 port 23935 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.251.122.86
country_id: 3017382
description:
2025-12-22 03:30:52 dovecot_plain authenticator failed for H=(myvm5.evyo5qjl14qe1exzla54i1z3rh.parx.internal.cloudapp.net) [4.251.122.86]:49246: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-22 03:33:27 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:50374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2025-12-22 03:34:20 dovecot_login authenticator failed for H=([127.0.0.1]) [24.121.1.156]:37536: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-22 03:33:51 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:55334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.211.57.196
country_id: 6252001
description:
2025-12-22 03:34:13 dovecot_login authenticator failed for H=wsip-72-211-57-196.lv.lv.cox.net ([127.0.0.1]) [72.211.57.196]:43459: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 03:36:20 host2 sshd[2996689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-22 03:37:08 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:52063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-22 03:37:27 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:54427: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-22 03:40:00 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:47068: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-22 03:40:19 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:60973: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.34.72.212
country_id: 1668284
description:
[2025-12-22 03:41:48 +0530] info [cpaneld] 1.34.72.212 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.169
country_id: 6252001
description:
Dec 22 03:41:53 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.169, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<BNQYmX1GbcPG6xip>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:49:57 host2 sshd[3012947]: Disconnected from invalid user scanner 49.204.74.149 port 37030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:51:33 host2 sshd[3014193]: Disconnected from invalid user wp 49.204.74.149 port 35670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:52:47 host2 sshd[3014652]: Disconnected from invalid user vicente 49.204.74.149 port 59286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:55:21 host2 sshd[3016783]: Disconnected from invalid user wp 123.58.213.52 port 57914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:54:48 host2 sshd[3016264]: Disconnected from invalid user amstest 123.58.213.52 port 49476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:55:54 host2 sshd[3017111]: Disconnected from invalid user carlos1 123.58.213.52 port 46092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 03:57:17 host2 sshd[3017997]: Disconnected from invalid user janiya 62.60.131.157 port 8048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-22 04:02:50 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:36552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-22 04:03:06 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:54716: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-22 04:05:58 dovecot_login authenticator failed for H=(221-169-97-62.cust.smartcall.no) [62.97.169.221]:48625: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-22 04:06:14 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:52506: 535 Incorrect authentication data (set_id=marketing)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-22 04:09:23 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:40082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.55
country_id: 798544
description:
Dec 22 04:10:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=77.65.142.55, lip=66.85.158.91, TLS, session=<ww/e/X1GHaRNQY43>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-22 04:09:40 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:37206: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.145
country_id: 2215636
description:
Dec 22 04:10:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=169.239.117.145, lip=66.85.158.91, TLS, session=<gQ25/H1Gzeyp73WR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.53
country_id: 798544
description:
Dec 22 04:14:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 10 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.231.122.53, lip=66.85.158.91, session=<ITcRDH5Gecxb53o1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Dec 22 04:13:46 host2 sshd[3032866]: Disconnected from invalid user jay 105.27.148.94 port 53428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 22 04:14:25 host2 sshd[3033385]: Disconnected from invalid user irfan 105.27.148.94 port 39218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.130
country_id: 690791
description:
Dec 22 04:14:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.157.130, lip=66.85.158.91, TLS, session=<NgDGDH5GwLYl3Z2C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-22 04:15:21 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:37231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-12-22 04:15:51 dovecot_login authenticator failed for H=([200.195.67.82]) [200.195.67.82]:35633: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-22 04:16:09 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:40803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Dec 22 04:17:24 host2 sshd[3036522]: Disconnected from invalid user prometheus 190.117.52.211 port 52812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 22 04:17:46 host2 sshd[3036774]: Disconnected from invalid user clamav 103.136.43.74 port 56974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 04:20:13 host2 pure-ftpd[3039931]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-22 04:20:50 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:60048: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-22 04:20:50 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:45796: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:21:37 host2 sshd[3041562]: Disconnected from invalid user clamav 162.214.92.14 port 60210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:22:10 host2 sshd[3042227]: Disconnected from invalid user vhpadmin 162.214.92.14 port 46056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Dec 22 04:22:41 host2 sshd[3042684]: Disconnected from invalid user vhpadmin 190.117.52.211 port 43766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-12-22 04:23:00 dovecot_login authenticator failed for H=(177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:35683: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Dec 22 04:23:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.119, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<muxXLH5G/NHG6xh3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:23:51 host2 sshd[3044019]: Disconnected from invalid user usuario1 162.214.92.14 port 60070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 04:24:47 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:41136: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 04:25:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (munsiver) [87.103.126.54]:28340: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 22 04:25:56 host2 sshd[3046860]: Disconnected from invalid user zcm 103.136.43.74 port 38176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec 22 04:26:46 host2 sshd[3048123]: Disconnected from invalid user vhpadmin 20.46.50.43 port 54756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Dec 22 04:27:20 host2 sshd[3048918]: Disconnected from invalid user admin 27.110.166.67 port 35962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Dec 22 04:27:24 host2 sshd[3049034]: Disconnected from invalid user steam 20.46.50.43 port 51424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-22 04:27:26 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:41742: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 22 04:27:34 host2 sshd[3049205]: Disconnected from invalid user test2 42.200.66.164 port 45734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:28:11 host2 sshd[3050037]: Disconnected from invalid user joao 108.85.73.156 port 36312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-12-22 04:28:18 dovecot_login authenticator failed for H=([118.26.153.84]) [118.26.153.84]:54034: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:28:57 host2 sshd[3051061]: Disconnected from invalid user deployer 108.85.73.156 port 39862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 22 04:29:58 host2 sshd[3052119]: Disconnected from invalid user leo 42.200.66.164 port 43226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:30:07 host2 sshd[3052451]: Disconnected from invalid user temp 108.85.73.156 port 37090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:29:20 host2 sshd[3051490]: Disconnected from invalid user ironman 188.166.156.169 port 54116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.110.166.67
country_id: 1694008
description:
Dec 22 04:30:44 host2 sshd[3053194]: Disconnected from invalid user soporte 27.110.166.67 port 41098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:30:45 host2 sshd[3053209]: Disconnected from invalid user 1 156.236.75.64 port 44454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-22 04:31:00 dovecot_login authenticator failed for H=([172.82.64.201]) [172.82.64.201]:42050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:30:21 host2 sshd[3052791]: Disconnected from invalid user ftpuser 188.166.156.169 port 44582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-22 04:31:41 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:32:07 host2 sshd[3054883]: Disconnected from invalid user wagner 107.175.89.172 port 58136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-22 04:32:17 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:24798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:31:22 host2 sshd[3053861]: Disconnected from invalid user ming 188.166.156.169 port 59474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:33:14 host2 sshd[3056219]: Disconnected from invalid user wagner 156.236.75.64 port 42426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:32:49 host2 sshd[3055748]: Disconnected from invalid user webadmin 108.85.73.156 port 46026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-22 04:32:53 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:39508: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:33:52 host2 sshd[3057000]: Disconnected from invalid user auditor 156.236.75.64 port 33230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:33:20 host2 sshd[3056338]: Disconnected from invalid user test 108.85.73.156 port 52760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-22 04:34:59 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35334: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 22 04:34:24 host2 sshd[3057659]: Disconnected from invalid user wagner 182.48.80.134 port 54824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-22 04:34:48 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:53250: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 22 04:35:40 host2 sshd[3059303]: Disconnected from invalid user ansibleuser 182.48.80.134 port 48040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:36:51 host2 sshd[3060784]: Disconnected from invalid user taylor 13.217.116.28 port 55022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:37:19 host2 sshd[3061214]: Disconnected from invalid user rust 107.175.89.172 port 48720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.48.12.87
country_id: 2510769
description:
Dec 22 04:37:55 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=83.48.12.87, lip=66.85.158.91, TLS, session=<BSN1YH5GO75TMAxX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-22 04:37:59 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:34652: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-22 04:37:46 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:52076: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:37:46 host2 sshd[3061780]: Disconnected from invalid user storm 13.217.116.28 port 45184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.154
country_id: 6290252
description:
Dec 22 04:38:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.98.154, lip=66.85.158.91, TLS, session=<W/0kYn5Gc9ltzmKa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:38:33 host2 sshd[3062862]: Disconnected from invalid user paula 13.217.116.28 port 35760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:39:22 host2 sshd[3063618]: Disconnected from invalid user juan 107.175.89.172 port 50858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-22 04:39:37 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:55992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 04:40:03 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-22 04:40:25 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:49100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-12-22 04:40:45 dovecot_login authenticator failed for H=([203.124.44.231]) [203.124.44.231]:38166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-22 04:43:08 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:38258: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-22 04:43:23 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:44995: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 04:45:11 host2 sshd[3071806]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:45:06 host2 sshd[3071376]: Disconnected from invalid user deploy 156.236.75.54 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:46:00 host2 sshd[3073420]: Disconnected from invalid user ubuntu 156.236.75.54 port 56448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:47:11 host2 sshd[3074589]: Disconnected from invalid user going 156.236.75.54 port 52698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:47:19 host2 sshd[3074702]: Disconnected from invalid user tech 162.0.216.227 port 54280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:47:33 host2 sshd[3074859]: Disconnected from invalid user up 107.175.89.172 port 38314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 22 04:51:39 host2 sshd[3078539]: Disconnected from invalid user jerry 51.68.175.56 port 36996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:52:24 host2 sshd[3079309]: Disconnected from invalid user ubuntu 162.0.216.227 port 45982 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:53:32 host2 sshd[3080243]: Received disconnect from 162.0.216.227 port 48200:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-22 04:54:01 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:36716: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-22 04:54:15 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:49420: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-22 04:55:14 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:3967: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2025-12-22 04:55:16 dovecot_login authenticator failed for H=([127.0.0.1]) [59.98.41.27]:48803: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:54:34 host2 sshd[3081617]: Disconnected from invalid user richard 162.0.216.227 port 55048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-22 04:55:28 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.43.27]:50178: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2025-12-22 04:56:20 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:50113: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 04:56:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:34215: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-22 04:57:35 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:41799: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 05:08:28 host2 sshd[3093836]: Disconnected from invalid user keyon 62.60.131.157 port 57712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-22 05:12:13 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:45359: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-22 05:12:28 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:37138: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-22 05:15:26 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (curgale) [24.15.216.41]:41166: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 05:22:41 host2 pure-ftpd[3105087]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Dec 22 05:25:52 host2 sshd[3107760]: Disconnected from invalid user wj 103.187.147.214 port 40410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-22 05:30:51 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:44178: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-22 05:31:20 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:44940: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-22 05:32:29 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (hytors) [73.176.157.57]:58948: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-22 05:35:53 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:43148: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-12-22 05:35:35 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [181.129.31.42]:33546: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.179.129
country_id: 3144096
description:
2025-12-22 05:43:31 dovecot_login authenticator failed for H=([127.0.0.1]) [84.213.179.129]:42615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.121.74.83
country_id: 1269750
description:
2025-12-22 05:43:40 dovecot_login authenticator failed for H=([127.0.0.1]) [103.121.74.83]:60600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 05:47:39 host2 sshd[3125694]: Disconnected from invalid user admin 2.57.121.112 port 49788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.119.148
country_id: 2921044
description:
Dec 22 05:49:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.119.148, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Hv7IYn9Gamil6HeU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.146
country_id: 798544
description:
Dec 22 05:53:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=46.20.58.146, lip=66.85.158.91, TLS, session=<kAQXbn9GaIwuFDqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.141
country_id: 1269750
description:
Dec 22 05:53:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.51.223.141, lip=66.85.158.91, TLS, session=<bInnbH9GR9xnM9+N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.245
country_id: 6252001
description:
Dec 22 05:53:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.245, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yp7HcH9GfNbG6xj1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:54:48 dovecot_login authenticator failed for H=(ZaNmZW9pOZ) [158.94.208.56]:62743: 535 Incorrect authentication data (set_id=dmch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:55:36 dovecot_login authenticator failed for H=(FllWXMR) [158.94.208.56]:59453: 535 Incorrect authentication data (set_id=dmch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:56:26 dovecot_login authenticator failed for H=(h07f8Olfm) [158.94.208.56]:64418: 535 Incorrect authentication data (set_id=dmch)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.94.208.56
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[158.94.208.56] [Authentication Database]=[mail] [Username]=[dmch] (5/5 failures) (blocked until [Mon Dec 22 00:41:24 2025 UTC/Mon Dec 22 06:11:24 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.141.198
country_id: 99237
description:
Dec 22 05:57:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=65.20.141.198, lip=66.85.158.91, TLS, session=<0ehefn9GhtdBFI3G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.149
country_id: 798544
description:
Dec 22 05:58:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=178.216.31.149, lip=66.85.158.91, TLS, session=<MoV1f39GPKmy2B+V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-22 06:00:05 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:51290: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-22 06:00:27 dovecot_login authenticator failed for H=([37.34.237.45]) [37.34.237.45]:37449: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.34
country_id: 1269750
description:
2025-12-22 06:01:48 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.34]:48906: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.223.182
country_id: 2921044
description:
Dec 22 06:01:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.223.182, lip=66.85.158.92, session=<Evkfjn9GqeWhI9+2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.121.160
country_id: 2921044
description:
Dec 22 06:02:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.121.160, lip=66.85.158.92, session=<HQ0tjn9GuDud5nmg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-22 06:02:35 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:35108: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-22 06:09:16 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:38312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-22 06:09:42 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:38020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-22 06:10:29 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:56658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.16
country_id: 798549
description:
Dec 22 06:11:03 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.16, lip=66.85.158.91, TLS: Connection closed, session=<tiOGrn9GmJtV2YwQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-22 06:11:20 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [186.179.100.129]:1351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-22 06:11:36 dovecot_login authenticator failed for H=(cm-84.210.149.45.get.no) [84.210.149.45]:50014: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 22 06:12:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.51, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2t31sn9GOsLN0h8z>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:13:43 host2 pure-ftpd[3144535]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:14:36 host2 pure-ftpd[3145206]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:14:40 host2 pure-ftpd[3145259]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.84
country_id: 2510769
description:
Dec 22 06:18:16 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=46.39.212.84, lip=66.85.158.91, TLS, session=<Pz9cx39G2K4uJ9RU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.164
country_id: 3865483
description:
Dec 22 06:18:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=179.0.251.164, lip=66.85.158.91, TLS, session=<QWSTyH9G6+azAPuk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-22 06:19:03 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:54312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2025-12-22 06:19:30 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:39344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-22 06:20:55 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-22 06:20:39 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:47282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:22:16 host2 sshd[3151128]: Disconnected from invalid user gemma 160.251.101.169 port 59338 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:22:55 host2 sshd[3151608]: Disconnected from invalid user jean 160.251.101.169 port 32888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:23:33 host2 sshd[3152107]: Disconnected from invalid user sk 160.251.101.169 port 57622 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 06:25:16 host2 pure-ftpd[3153597]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-22 06:26:18 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:49804: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-22 06:26:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:48238: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Dec 22 06:29:02 host2 sshd[3156495]: Disconnected from invalid user user3 133.117.72.88 port 54100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 133.117.72.88
country_id: 1861060
description:
Dec 22 06:30:00 host2 sshd[3156932]: Disconnected from invalid user teamspeak3 133.117.72.88 port 40624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-22 06:30:06 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (symigoto) [174.161.27.82]:60428: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-22 06:31:42 dovecot_login authenticator failed for H=(syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:44786: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-22 06:32:08 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:47118: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.47
country_id: 6252001
description:
Dec 22 06:34:00 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.5.47, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cNqZAIBGYKoSYQUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-22 06:34:00 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:55522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-22 06:34:19 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:44536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:35:21 host2 sshd[3161063]: Disconnected from invalid user test2 201.76.120.30 port 46256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:36:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<b7f6CYBGYtMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:36:49 host2 sshd[3162202]: Disconnected from invalid user ftpuser 201.76.120.30 port 38252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:37:35 host2 sshd[3162688]: Disconnected from invalid user admin 201.76.120.30 port 50160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:39:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zbVSFIBG5M4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-22 06:40:45 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:55999: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-12-22 06:42:13 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:37398: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.114.67
country_id: 798544
description:
Dec 22 06:41:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=155.133.114.67, lip=66.85.158.91, TLS, session=<CLpZGoBG7I6bhXJD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 06:41:28 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:46016: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-22 06:41:33 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:43980: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:41:58 host2 sshd[3166312]: Disconnected from invalid user docker 138.197.31.20 port 60622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-12-22 06:41:58 dovecot_login authenticator failed for H=([200.195.67.82]) [200.195.67.82]:49994: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-22 06:41:25 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:59289: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:41:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<zm1KHIBG3usDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.148
country_id: 732800
description:
Dec 22 06:41:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.212.148, lip=66.85.158.91, TLS, session=<m/VsG4BGtYi5/9SU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.202.82.102
country_id: 1861060
description:
2025-12-22 06:41:49 dovecot_login authenticator failed for H=fp5cca5266.gifg408.ap.nuro.jp [92.202.82.102]:22450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:42:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6+9LH4BGht8DgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:43:07 host2 sshd[3167098]: Disconnected from invalid user bot1 138.197.31.20 port 37976 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:43:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dRIKI4BGxJ4DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.31.20
country_id: 6252001
description:
Dec 22 06:43:53 host2 sshd[3167867]: Disconnected from invalid user developer 138.197.31.20 port 37678 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-22 06:45:21 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:50480: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-22 06:45:21 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:57898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:45:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<u9/3KoBGXMkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-22 06:45:53 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:58536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-22 06:46:09 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:35799: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-22 06:46:11 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:56682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-22 06:45:27 dovecot_login authenticator failed for H=([49.124.153.40]) [49.124.153.40]:34920: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-22 06:45:41 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:37833: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-22 06:45:50 dovecot_login authenticator failed for H=([149.54.51.162]) [149.54.51.162]:51527: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-22 06:46:36 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:47661: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:49:06 host2 sshd[3172138]: Disconnected from invalid user ubuntu 118.193.43.167 port 28276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:51:45 host2 sshd[3174131]: Disconnected from invalid user test1 36.91.81.195 port 36596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:51:27 host2 sshd[3173973]: Disconnected from invalid user k8s 118.193.43.167 port 13624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:52:35 host2 sshd[3174697]: Disconnected from invalid user ldap 118.193.43.167 port 38286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:54:11 host2 sshd[3175978]: Disconnected from invalid user es 36.91.81.195 port 55460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.186
country_id: 3144096
description:
2025-12-22 06:53:29 dovecot_login authenticator failed for H=([127.0.0.1]) [62.97.161.186]:53254: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 22 06:53:46 host2 sshd[3175469]: Disconnected from invalid user ubuntu 118.193.43.167 port 62948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-22 06:53:51 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([127.0.0.1]) [62.103.27.217]:16056: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:55:21 host2 sshd[3177080]: Disconnected from invalid user user10 36.91.81.195 port 50780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-22 06:56:34 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.58.18]:40418: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2025-12-22 06:56:41 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se ([127.0.0.1]) [155.4.72.204]:47418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-22 06:57:02 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (maized) [73.213.237.28]:33150: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Dec 22 06:58:07 host2 sshd[3179166]: Disconnected from invalid user morteza 78.89.154.59 port 57308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 22 06:57:20 host2 sshd[3178573]: Disconnected from invalid user sysadmin 78.89.154.59 port 36386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.81.195
country_id: 1643084
description:
Dec 22 06:57:47 host2 sshd[3178847]: Disconnected from invalid user ubuntu 36.91.81.195 port 41410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-22 06:59:28 dovecot_plain authenticator failed for H=(subily) [65.20.233.110]:41215: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 07:00:06 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (syncial) [87.103.126.54]:40193: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-22 07:00:22 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:57929: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.241.4
country_id: 290557
description:
2025-12-22 07:00:47 dovecot_login authenticator failed for H=([98.98.241.4]) [98.98.241.4]:36293: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-22 07:01:04 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:52818: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-12-22 07:02:47 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:38078: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-22 07:03:04 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:59813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 07:06:30 host2 sshd[3185910]: Disconnected from invalid user user 2.57.121.25 port 7165 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-22 07:15:59 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (irowed) [73.213.236.66]:50748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-22 07:16:03 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (bathiess) [174.166.153.20]:57776: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-22 07:16:12 dovecot_plain authenticator failed for H=(onrancet) [199.192.123.12]:45942: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-22 07:20:02 dovecot_plain authenticator failed for H=(behomen) [65.20.233.110]:53065: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-22 07:27:05 dovecot_plain authenticator failed for H=(micaplace) [94.206.93.90]:47279: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 07:27:40 host2 pure-ftpd[3206074]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-12-22 07:28:37 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:54508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 07:28:54 dovecot_login authenticator failed for H=(223-30-0-0.lan.sify.net) [136.232.73.130]:52534: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-22 07:31:05 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:55880: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-22 07:32:00 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:33020: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.162.254
country_id: 6252001
description:
Dec 22 07:33:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.235.162.254, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Ed651oBGaJ5K66L+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 22 07:34:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, session=<Kocz2oBGyORAPpxs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 22 07:35:16 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, session=<2C7C24BGjP5APpxs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.164
country_id: 2635167
description:
Dec 22 07:35:26 host2 pure-ftpd[3213184]: (?@87.236.176.164) [INFO] New connection from 87.236.176.164


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Dec 22 07:36:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.92, TLS, session=<9Yus4YBGMvLG6xjo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.166
country_id: 6252001
description:
Dec 22 07:40:13 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.104.166, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Uhtv7YBGrM+symim>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 07:41:29 host2 sshd[3218379]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Dec 22 07:41:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<nbMm8oBGfrQD7a3c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 22 07:47:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<OnoHCIFGVog2xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.165
country_id: 6252001
description:
Dec 22 07:49:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wtT4D4FGIdKTuYSl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 07:51:36 host2 sshd[3227266]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-22 07:52:42 dovecot_login authenticator failed for H=([152.52.92.105]) [152.52.192.74]:34752: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-22 07:52:54 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:50662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 08:03:05 host2 sshd[3240046]: Disconnected from invalid user kameron 62.60.131.157 port 60406 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.32
country_id: 2750405
description:
Dec 22 08:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, TLS, session=<ZO1dP4FG6oFWNh8g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 2750405
description:
Dec 22 08:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<p85nP4FGvIpWNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-22 08:05:46 dovecot_login authenticator failed for H=([125.19.163.58]) [125.19.163.58]:59076: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-22 08:06:00 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:37480: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-22 08:08:24 dovecot_login authenticator failed for H=([154.208.47.13]) [154.208.47.13]:51582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-22 08:08:39 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:38580: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 08:11:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<cRJ7W4FGeITBHmEh>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:34 host2 sshd[3253275]: Disconnecting authenticating user root 176.235.182.73 port 42003: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:45 host2 sshd[3253531]: error: maximum authentication attempts exceeded for invalid user admin from 176.235.182.73 port 44903 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:48 host2 sshd[3253588]: Disconnecting invalid user admin 176.235.182.73 port 45603: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Dec 22 08:13:34 host2 sshd[3253275]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 42003 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 08:15:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (statip) [87.103.126.54]:65031: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-22 08:19:05 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:38662: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.129
country_id: 2186224
description:
2025-12-22 08:19:18 dovecot_login authenticator failed for H=([121.73.168.129]) [121.73.168.129]:54078: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 08:19:24 host2 sshd[3260406]: Disconnected from invalid user admin 2.57.121.112 port 21137 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.168.241.57
country_id: 798544
description:
Dec 22 08:22:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=193.168.241.57, lip=66.85.158.91, TLS, session=<qJbygoFGL67BqPE5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.119.120.223
country_id: 798544
description:
Dec 22 08:22:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.119.120.223, lip=66.85.158.91, TLS, session=<HMzbgYFGUd65d3jf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-22 08:24:11 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (fisaler) [24.127.53.61]:39822: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-22 08:26:11 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:63795: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.7
country_id: 3175395
description:
Dec 22 08:29:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.170.7, lip=66.85.158.91, TLS, session=<Z+FPnYFG5au5D6oH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.95
country_id: 3865483
description:
Dec 22 08:30:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.1.224.95, lip=66.85.158.91, TLS, session=<sL12noFGaq+6AeBf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 08:30:20 host2 pure-ftpd[3270251]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2025-12-22 08:31:38 +0530] info [cpaneld] 139.59.46.198 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:33:02 host2 sshd[3272714]: Disconnected from invalid user vikas 142.93.126.22 port 47692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.121.114.97
country_id: 2589581
description:
2025-12-22 08:34:50 dovecot_plain authenticator failed for H=(BLQ8UWWR76TP98) [154.121.114.97]:35967: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.121.114.97
country_id: 2589581
description:
2025-12-22 08:34:56 dovecot_login authenticator failed for H=(BLQ8UWWR76TP98) [154.121.114.97]:35967: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:35:09 host2 sshd[3274543]: Disconnected from invalid user rdp 45.172.152.74 port 51154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 08:36:55 host2 sshd[3275882]: Disconnected from invalid user raina 62.60.131.157 port 54068 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.243
country_id: 6252001
description:
Dec 22 08:38:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.243, lip=66.85.158.91, session=<lxLUvIFGgdlb5qjz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.241
country_id: 6252001
description:
Dec 22 08:38:36 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.241, lip=66.85.158.91, session=<xJU8voFGOddb5qjx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:38:43 host2 sshd[3277255]: Disconnected from invalid user rust 142.93.126.22 port 32910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:39:21 host2 sshd[3277901]: Disconnected from invalid user ali 45.172.152.74 port 53958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:39:24 host2 sshd[3277925]: Disconnected from invalid user rdp 103.226.139.139 port 39040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:39:47 host2 sshd[3278238]: Disconnected from invalid user deploy 142.93.126.22 port 45366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:39:57 host2 sshd[3278369]: Disconnected from invalid user matt 45.172.152.74 port 51594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-22 08:40:20 dovecot_plain authenticator failed for H=(ometers) [65.20.191.12]:59903: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:40:45 host2 sshd[3279241]: Disconnected from invalid user steamcmd 103.226.139.139 port 34928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Dec 22 08:40:47 host2 sshd[3279281]: Disconnected from invalid user git 142.93.126.22 port 56898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:41:56 host2 sshd[3280190]: Disconnected from invalid user dev 103.226.139.139 port 59052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:43:21 host2 sshd[3281596]: Disconnected from invalid user deploy 45.172.152.74 port 37078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 22 08:43:55 host2 sshd[3282072]: Disconnected from invalid user dev 45.172.152.74 port 58556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:44:28 host2 sshd[3282604]: Disconnected from invalid user user2 103.226.139.139 port 50838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 22 08:45:05 host2 sshd[3283364]: Disconnected from invalid user mohammad 103.226.139.139 port 34668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-22 08:47:03 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:44422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 08:47:31 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:60678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 08:49:05 host2 sshd[3287915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Dec 22 08:50:16 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.86, lip=66.85.158.91, session=<h+T054FGePLN0h9W>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-22 08:51:00 dovecot_login authenticator failed for H=(cm-178.232.111.229.get.no) [178.232.111.229]:36107: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.148.44.92
country_id: 2077456
description:
2025-12-22 08:53:08 dovecot_login authenticator failed for H=ip-206-148-44-92.internet.url.net.au [206.148.44.92]:38237: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-22 08:53:41 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:38674: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:00:43 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GdRLDYJG/saTuYVf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 22 09:00:48 host2 sshd[3298542]: Disconnected from invalid user pratik 177.53.215.134 port 58996 [preauth]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:38 host2 pure-ftpd[3299220]: (?@171.4.232.131) [WARNING] Authentication failed for user [smtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:01:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CWt0DoJGgumTuYVf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:33 host2 sshd[3299219]: Invalid user smtp.zoho.com587hr@lezzarotech.com from 171.4.232.131 port 53676


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 171.4.232.131
country_id: 1605651
description:
Dec 22 09:01:31 host2 pure-ftpd[3299220]: (?@171.4.232.131) [INFO] New connection from 171.4.232.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-22 09:02:14 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:53822: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 22 09:02:30 host2 sshd[3300002]: Disconnected from invalid user httpd 177.53.215.134 port 38726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-22 09:02:42 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:55699: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:02:54 host2 sshd[3300255]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.52
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EeVRFYJGM9stnIA0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-22 09:03:20 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:59234: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.51
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.51, lip=66.85.158.92, TLS, session=<KshIFYJGMJ8tnIAz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.52
country_id: 2264397
description:
Dec 22 09:02:56 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.52, lip=66.85.158.92, TLS, session=<hpNEFYJGM94tnIA0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.53
country_id: 2264397
description:
Dec 22 09:02:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.53, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V/ZWFYJGb44tnIA1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2025-12-22 09:02:58 dovecot_login authenticator failed for H=([207.134.139.173]) [207.134.139.170]:56745: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.54
country_id: 2264397
description:
Dec 22 09:03:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.156.128.54, lip=66.85.158.92, TLS, session=<AvOFFYJG7ZQtnIA2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2025-12-22 09:04:53 +0530] info [cpaneld] 217.172.189.13 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 22 09:06:24 host2 sshd[3303284]: Disconnected from invalid user qa 118.194.250.11 port 35412 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.95
country_id: 6252001
description:
Dec 22 09:05:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.95, lip=66.85.158.92, TLS, session=<PqXkH4JGXOqTuYVf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2025-12-22 09:08:35 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:49369: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-22 09:08:55 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:50702: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 22 09:10:35 host2 sshd[3306840]: Disconnected from invalid user proxyuser 118.194.250.11 port 33458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 22 09:13:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.171.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ywKfOoJGcNOkXKuE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.74.18
country_id: 1269750
description:
2025-12-22 09:14:47 dovecot_plain authenticator failed for H=(7J2Z8VH88YREWO) [106.76.74.18]:5420: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-22 09:14:48 dovecot_plain authenticator failed for H=(copoly) [12.150.243.22]:23195: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.76.74.18
country_id: 1269750
description:
2025-12-22 09:14:54 dovecot_login authenticator failed for H=(7J2Z8VH88YREWO) [106.76.74.18]:5420: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.5
country_id: 798549
description:
Dec 22 09:15:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.5, lip=66.85.158.91, session=<pTpyQYJGkIvUSZQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-12-22 09:17:20 dovecot_login authenticator failed for H=([45.82.109.136]) [45.82.109.136]:60636: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-22 09:17:44 dovecot_login authenticator failed for H=(cm-178.232.55.16.get.no) [178.232.55.16]:47662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:19:12 host2 sshd[3313721]: Disconnected from invalid user bot1 34.85.163.94 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:21:05 host2 sshd[3315623]: Disconnected from invalid user max 34.85.163.94 port 58380 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:21:46 host2 sshd[3316094]: Disconnected from invalid user benoit 34.85.163.94 port 47178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-22 09:22:20 dovecot_login authenticator failed for H=(189.218.82.49-clientes-izzi.mx) [189.218.82.49]:33988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-22 09:22:48 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:37947: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Dec 22 09:23:12 host2 sshd[3317139]: Disconnected from invalid user gaurav 34.85.163.94 port 54032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:23:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VSIcX4JGlNaTuYWd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:24:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZyyQYoJGhOiTuYWd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 09:24:43 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:39553: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-22 09:24:13 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:36318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-22 09:25:06 dovecot_login authenticator failed for H=([131.108.162.24]) [131.108.162.24]:40492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:25:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<pF9/ZIJGvueTuYWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.119.109
country_id: 3865483
description:
Dec 22 09:25:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=190.181.119.109, lip=66.85.158.91, TLS, session=<v9YEZIJGLMW+tXdt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.162
country_id: 3469034
description:
Dec 22 09:25:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=191.53.129.162, lip=66.85.158.91, TLS, session=<VgQyZYJG+LS/NYGi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:25:59 host2 sshd[3319497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 22 09:26:25 host2 pure-ftpd[3319947]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 09:27:29 host2 sshd[3320656]: Disconnected from invalid user user 2.57.121.25 port 52111 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-22 09:28:00 dovecot_plain authenticator failed for H=(nonanine) [65.20.129.28]:44836: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-22 09:28:48 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:48646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-22 09:28:02 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:45198: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.111
country_id: 6252001
description:
Dec 22 09:28:58 host2 pure-ftpd[3322162]: (?@195.184.76.111) [INFO] New connection from 195.184.76.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.174.206.114
country_id: 6252001
description:
[2025-12-22 09:29:00 +0530] info [cpaneld] 72.174.206.114 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.249.41.23
country_id: 6252001
description:
[2025-12-22 09:29:03 +0530] info [cpaneld] 47.249.41.23 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.29.200
country_id: 6252001
description:
[2025-12-22 09:29:08 +0530] info [whostmgrd] 35.151.29.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.205.191
country_id: 6252001
description:
[2025-12-22 09:29:13 +0530] info [cpaneld] 74.141.205.191 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.216
country_id: 3017382
description:
Dec 22 09:29:21 host2 pure-ftpd[3322561]: (?@91.231.89.216) [INFO] New connection from 91.231.89.216


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.24
country_id: 6252001
description:
Dec 22 09:28:58 host2 pure-ftpd[3322158]: (?@195.184.76.24) [INFO] New connection from 195.184.76.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.17.125
country_id: 6252001
description:
[2025-12-22 09:29:04 +0530] info [cpaneld] 172.56.17.125 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.117.134.16
country_id: 6252001
description:
[2025-12-22 09:29:11 +0530] info [cpaneld] 70.117.134.16 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.127.229.205
country_id: 6252001
description:
[2025-12-22 09:29:14 +0530] info [cpaneld] 70.127.229.205 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:31:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS, session=<BmZ2fIJGeP2TuYWd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.157
country_id: 6252001
description:
Dec 22 09:32:02 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.157, lip=66.85.158.91, TLS, session=<89dSfYJGZuSTuYWd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-22 09:32:02 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:38236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 09:32:49 host2 pure-ftpd[3326445]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.118.66
country_id: 1269750
description:
2025-12-22 09:32:58 dovecot_plain authenticator failed for H=(GXA8DC) [49.204.118.66]:41447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 09:36:06 host2 sshd[3329837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-22 09:40:16 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net ([127.0.0.1]) [189.203.180.173]:34322: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.148.129
country_id: 3144096
description:
2025-12-22 09:40:23 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.148.129]:49711: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-22 09:41:03 dovecot_login authenticator failed for H=(ipv4-124-186-245-43.as55666.net) [43.245.186.121]:34496: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-22 09:41:31 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:51752: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 09:41:37 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:53658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-22 09:40:59 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:60680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.24
country_id: 1269750
description:
Dec 22 09:43:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.8.118.24, lip=66.85.158.91, TLS, session=<PW9to4JGsMRnCHYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.205
country_id: 798544
description:
Dec 22 09:43:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.216.29.205, lip=66.85.158.91, TLS, session=<5Tq7pIJGUOKy2B3N>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 09:44:24 host2 sshd[3338910]: Disconnected from invalid user dayna 62.60.131.157 port 64701 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.173
country_id: 298795
description:
2025-12-22 10:00:56 dovecot_login authenticator failed for H=([5.11.168.173]) [5.11.168.173]:51726: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2025-12-22 10:02:41 dovecot_plain authenticator failed for H=host-188-11-17-169.business.telecomitalia.it (ulostotic) [188.11.17.169]:57714: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 10:02:31 host2 sshd[3355810]: Disconnected from invalid user user 2.57.121.25 port 16221 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-22 10:02:35 dovecot_plain authenticator failed for H=(bemis) [65.20.148.194]:47929: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-22 10:16:07 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (prepwooft) [68.40.189.43]:45644: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.15.180.31
country_id: 6252001
description:
Dec 22 10:17:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.15.180.31, lip=66.85.158.91, session=<z/AdH4NGrsoDD7Qf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.172.46
country_id: 6252001
description:
Dec 22 10:17:08 host2 sshd[3367477]: Invalid user cloudtourssrilan_travel from 159.65.172.46 port 54300


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 10:17:56 host2 sshd[3368078]: Disconnected from invalid user katy 62.60.131.157 port 42463 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-22 10:18:25 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (parifil) [73.168.136.150]:57552: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-22 10:20:14 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (taffinely) [73.168.136.150]:36282: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.172.46
country_id: 6252001
description:
Dec 22 10:21:27 host2 sshd[3370990]: Invalid user cloudtourssrilan_travel from 159.65.172.46 port 60368


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.179.34
country_id: 1880251
description:
Dec 22 10:23:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact>, method=PLAIN, rip=188.166.179.34, lip=66.85.158.91, session=<a03CNING2sW8prMi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.99.14
country_id: 290557
description:
Dec 22 10:23:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=5.32.99.14, lip=66.85.158.91, TLS, session=<3vBfNINGy8kFIGMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.239.45.10
country_id: 1269750
description:
Dec 22 10:23:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.239.45.10, lip=66.85.158.91, TLS, session=<e3/0MoNGeuN17y0K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.22.218
country_id: 290557
description:
Dec 22 10:23:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=5.32.22.218, lip=66.85.158.91, TLS, session=<91cbM4NGBJwFIBba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.22.218
country_id: 290557
description:
Dec 22 10:24:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact>, method=PLAIN, rip=5.32.22.218, lip=66.85.158.91, session=<Y5n9NoNGhq8FIBba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.114.140.70
country_id: 3469034
description:
Dec 22 10:24:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=189.114.140.70, lip=66.85.158.91, TLS, session=<Ku5JN4NGH9K9coxG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 10:24:54 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nesman) [87.103.126.54]:25033: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-22 10:25:23 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:36007: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-22 10:25:38 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:46904: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-22 10:26:17 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:53335: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-22 10:26:39 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:33646: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-22 10:27:54 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:4752: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-22 10:28:08 dovecot_login authenticator failed for H=([182.78.241.30]) [182.78.241.30]:34948: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.178.172.20
country_id: 6252001
description:
Dec 22 10:28:45 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 85 secs): user=<>, rip=184.178.172.20, lip=66.85.158.91, session=<IDchSINGTr64sqwU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-22 10:28:58 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:42076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-22 10:29:13 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:44492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.91
country_id: 798544
description:
Dec 22 10:31:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=91.246.210.91, lip=66.85.158.91, TLS, session=<qZupUoNGeexb9tJb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.62.177.104
country_id: 3469034
description:
Dec 22 10:31:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=187.62.177.104, lip=66.85.158.91, TLS, session=<e3ywUoNG/K27PrFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Dec 22 10:32:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<sJK4U4NGlaaAf15N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.154.21
country_id: 99237
description:
Dec 22 10:32:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=65.20.154.21, lip=66.85.158.91, TLS, session=<RcLJU4NG0dpBFJoV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 22 10:35:15 host2 pure-ftpd[3381906]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 10:35:24 host2 pure-ftpd[3382035]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.93
country_id: 690791
description:
Dec 22 10:38:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=176.103.25.93, lip=66.85.158.91, TLS, session=<l8wlaYNGYcuwZxld>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.234.3
country_id: 798544
description:
Dec 22 10:37:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=109.125.234.3, lip=66.85.158.91, TLS, session=<ogcFaINGZ+BtfeoD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 22 10:40:17 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<qHxhcYNG8qc26lCA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 22 10:46:02 host2 pure-ftpd[3390721]: (?@164.92.171.132) [INFO] New connection from 164.92.171.132


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.202.199
country_id: 2921044
description:
Dec 22 10:46:01 host2 pure-ftpd[3390687]: (?@164.92.202.199) [INFO] New connection from 164.92.202.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-22 10:55:35 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (renitione) [98.227.25.115]:50948: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-22 10:57:34 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:49078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-22 10:58:15 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.202]:4218: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-22 10:58:41 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:56228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-22 10:58:12 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:35917: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Dec 22 11:05:45 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS: Connection closed, session=<Gcd4zING1BFChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Dec 22 11:05:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CLXJzINGAF5ChJmE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.253.156.155
country_id: 6252001
description:
[2025-12-22 11:10:30 +0530] info [cpaneld] 68.253.156.155 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.83.120
country_id: 6252001
description:
[2025-12-22 11:10:35 +0530] info [cpaneld] 47.32.83.120 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.38.144.128
country_id: 6252001
description:
[2025-12-22 11:10:34 +0530] info [cpaneld] 71.38.144.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.10.112
country_id: 6252001
description:
[2025-12-22 11:10:36 +0530] info [whostmgrd] 98.97.10.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.198.87.217
country_id: 6252001
description:
[2025-12-22 11:10:39 +0530] info [cpaneld] 71.198.87.217 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.3.202.64
country_id: 6252001
description:
[2025-12-22 11:10:41 +0530] info [cpaneld] 107.3.202.64 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.12.211.73
country_id: 6252001
description:
[2025-12-22 11:10:42 +0530] info [cpaneld] 108.12.211.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 11:11:10 host2 sshd[3410184]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-22 11:14:02 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:42509: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-22 11:14:22 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:50848: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-22 11:19:48 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:43622: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.126
country_id: 2963597
description:
Dec 22 11:20:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=37.203.49.126, lip=66.85.158.91, TLS, session=<xoKr/oNGGMUlyzF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.107.226.235
country_id: 3865483
description:
Dec 22 11:20:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=200.107.226.235, lip=66.85.158.91, TLS, session=<QLiFAIRGOJPIa+Lr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 11:21:19 host2 sshd[3417792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-22 11:23:03 dovecot_login authenticator failed for H=([203.193.147.37]) [203.193.147.37]:50870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-22 11:23:29 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:57648: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-22 11:30:31 dovecot_login authenticator failed for H=([182.95.24.117]) [182.95.56.134]:60460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-12-22 11:31:02 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:50613: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-22 11:31:21 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:43410: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.29
country_id: 1733045
description:
2025-12-22 11:33:29 dovecot_login authenticator failed for H=([49.124.153.29]) [49.124.153.29]:56276: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-22 11:33:40 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:50728: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 11:35:40 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (prosen) [87.103.126.54]:43736: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.122.86
country_id: 6252001
description:
Dec 22 11:37:10 host2 sshd[3429454]: Disconnected from invalid user steam 167.99.122.86 port 59404 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 11:37:27 host2 pure-ftpd[3429665]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-12-22 11:37:34 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:59240: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-22 11:38:22 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:48960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-22 11:37:58 dovecot_login authenticator failed for H=([128.185.247.254]) [125.19.158.2]:38670: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.122.86
country_id: 6252001
description:
Dec 22 11:38:12 host2 sshd[3430234]: Disconnected from invalid user bitrix 167.99.122.86 port 51552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-22 11:41:38 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:38792: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Dec 22 11:45:11 host2 sshd[3436460]: Disconnected from invalid user app 196.0.120.6 port 46814 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.6
country_id: 226074
description:
Dec 22 11:46:40 host2 sshd[3438197]: Disconnected from invalid user leonardo 196.0.120.6 port 57970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-22 11:46:21 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:45802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-22 11:46:51 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:41240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 22 11:50:39 host2 dovecot[1601669]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<7dMRbYRG215whtWE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.47.16.142
country_id: 3686110
description:
Dec 22 11:54:33 host2 pure-ftpd[3445205]: (?@154.47.16.142) [INFO] New connection from 154.47.16.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.158
country_id: 146669
description:
Dec 22 11:54:32 host2 pure-ftpd[3445196]: (?@185.253.162.158) [INFO] New connection from 185.253.162.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2025-12-22 11:55:26 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:42965: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-22 11:55:57 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:48312: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-22 11:56:18 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:38350: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Dec 22 11:55:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yGC0f4RGIyDBJf1d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 11:59:13 host2 sshd[3449381]: Disconnected from invalid user admin 2.57.121.112 port 56455 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-22 12:00:18 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:56962: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-22 12:00:00 dovecot_login authenticator failed for H=([188.72.74.130]) [188.72.74.130]:49966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-12-22 12:01:39 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:50345: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-22 12:02:20 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:53528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.15
country_id: 798549
description:
Dec 22 12:02:56 host2 pure-ftpd[3452666]: (?@85.217.140.15) [INFO] New connection from 85.217.140.15


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.15
country_id: 798549
description:
Dec 22 12:03:08 host2 pure-ftpd[3453033]: (?@85.217.140.15) [INFO] New connection from 85.217.140.15


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 22 12:04:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<C3iYnYRGT4vJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.181
country_id: 3865483
description:
Dec 22 12:05:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=181.118.183.181, lip=66.85.158.91, TLS, session=<1tBan4RG/qm1dre1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-22 12:11:58 dovecot_plain authenticator failed for H=78-66-119-139-no600.tbcn.telia.com (belphal) [78.66.119.139]:54796: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.166.74
country_id: 2921044
description:
Dec 22 12:15:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.166.74, lip=66.85.158.92, TLS, session=<htyLxoRGliikWqZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.242.175.76
country_id: 298795
description:
Dec 22 12:21:30 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=178.242.175.76, lip=66.85.158.91, TLS, session=<zsQ/24RGGKqy8q9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:21:30 host2 sshd[3471284]: Disconnected from invalid user devel 51.91.252.38 port 53916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 22 12:22:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=178.128.203.219, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TkRK3oRG2KCygMvb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:22:34 host2 sshd[3472216]: Disconnected from invalid user deploy 51.91.252.38 port 34576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-22 12:22:55 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:65447: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-22 12:23:25 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:54874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:24:07 host2 sshd[3473496]: Disconnected from invalid user backup 103.171.85.117 port 58316 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 22 12:25:06 host2 sshd[3474434]: Received disconnect from 51.91.252.38 port 44160:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:28:00 host2 sshd[3476735]: Disconnected from invalid user deploy 103.171.85.117 port 40494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Dec 22 12:30:55 host2 sshd[3479496]: Disconnected from invalid user admin 103.171.85.117 port 34284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-22 12:30:59 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:39200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-22 12:31:34 dovecot_login authenticator failed for H=([144.24.107.1]) [144.24.107.1]:37124: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 12:39:18 host2 pure-ftpd[3486522]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Dec 22 12:39:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<uuC/GoVGiNeyMLU6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.189
country_id: 3865483
description:
Dec 22 12:39:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.250.189, lip=66.85.158.91, TLS, session=<SSf1G4VGf7yzAPq9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Dec 22 12:48:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS, session=<9LowO4VGruyTuYRJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Dec 22 12:50:39 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<MCOhQ4VGWJAD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.249
country_id: 1733045
description:
2025-12-22 12:54:26 dovecot_login authenticator failed for H=([49.124.152.249]) [49.124.152.249]:49598: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-22 12:54:39 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:59570: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-22 12:54:56 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (chgral) [174.161.27.82]:39567: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 12:56:34 host2 sshd[3502554]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 12:57:23 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61992: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-22 12:57:44 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:60957: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-22 12:59:23 dovecot_login authenticator failed for H=pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:48839: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-22 12:59:54 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:34721: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 12:59:55 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<2fXLZIVG5KADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:00:51 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tYUZaIVGONQDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-22 13:01:55 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:50238: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:02:02 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0bRabIVGrsUDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-22 13:01:25 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:46352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-12-22 13:01:47 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:46258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:03:01 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nfXab4VGuq8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:03:51 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4CnacoVGPLgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:04:50 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<z0xbdoVGPLkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:05:37 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<joEteYVGlM0DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:05:46 host2 dovecot[1601669]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<HPqueYVGwsADgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 13:06:46 host2 sshd[3510718]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:06:34 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ztaUfIVGZokDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:06:45 host2 dovecot[1601669]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<AfwxfYVG2pIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:07:46 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BnHTgIVGHrMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 13:08:44 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<L4hRhIVGRpkDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 13:10:54 host2 sshd[3513668]: Disconnected from invalid user admin 2.57.121.112 port 55650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-22 13:12:22 dovecot_login authenticator failed for H=([46.212.119.125]) [46.212.119.125]:52027: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-22 13:12:50 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:47944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-22 13:12:55 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (oxyging) [76.106.163.189]:59448: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 22 13:14:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<DDJ8moVGcOQDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-12-22 13:15:09 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:46872: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-22 13:14:50 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:49055: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-22 13:16:58 dovecot_login authenticator failed for H=([177.236.146.244]) [177.236.146.244]:39913: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-22 13:17:14 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:53284: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 13:19:20 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unfouter) [87.103.126.54]:33928: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-22 13:20:46 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:53436: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-22 13:21:06 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:47752: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Dec 22 13:25:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<C23LwYVGCs6TuYQ/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.157.211.217
country_id: 1643084
description:
Dec 22 13:27:21 host2 sshd[3527609]: Disconnected from invalid user mailuser 43.157.211.217 port 58812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 22 13:28:59 host2 sshd[3528692]: Disconnected from invalid user user 59.97.205.137 port 43235 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-22 13:30:38 dovecot_login authenticator failed for H=([196.191.142.67]) [196.191.142.67]:41596: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.44.144
country_id: 2921044
description:
Dec 22 13:32:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=8.211.44.144, lip=66.85.158.92, session=<Haqg2YVGUI0I0yyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.228.96
country_id: 1643084
description:
Dec 22 13:35:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=165.154.228.96, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AXxs4oVGpNOlmuRg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-22 13:34:29 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:41450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-12-22 13:34:45 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:58686: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-22 13:35:27 dovecot_plain authenticator failed for H=(crostalaw) [24.105.248.218]:58016: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-22 13:36:03 dovecot_plain authenticator failed for H=amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (untle) [90.0.156.128]:40826: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-22 13:36:05 dovecot_plain authenticator failed for H=c-76-31-164-124.hsd1.tx.comcast.net (trinorpom) [76.31.164.124]:37500: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.228.96
country_id: 1643084
description:
Dec 22 13:39:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.228.96, lip=66.85.158.91, TLS, session=<z6QI8YVG4K6lmuRg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.62.177.90
country_id: 3469034
description:
Dec 22 13:40:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=187.62.177.90, lip=66.85.158.91, TLS, session=<ht7G84VGF467PrFa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.163
country_id: 3865483
description:
Dec 22 13:40:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=179.0.249.163, lip=66.85.158.91, TLS, session=<Sn0Z9YVGI6uzAPmj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 13:41:48 host2 pure-ftpd[3541718]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 22 13:43:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<EKHsAIZGqr1ChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 13:44:20 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<H5B7A4ZG5OrBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.10
country_id: 3175395
description:
Dec 22 13:44:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.10, lip=66.85.158.91, TLS, session=<VuqBBIZGCoC5D6sK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Dec 22 13:45:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<8h2mBYZG+pazAPqa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 13:46:42 host2 sshd[3547424]: Disconnected from invalid user admin 2.57.121.112 port 65506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-22 13:47:59 dovecot_plain authenticator failed for H=(larassed) [64.72.74.162]:58784: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 22 13:52:19 host2 pure-ftpd[3553767]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.152.250.192
country_id: 3469034
description:
Dec 22 13:54:15 host2 sshd[3556461]: Disconnected from invalid user wireguard 164.152.250.192 port 60448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:57:14 host2 sshd[3560527]: Disconnected from invalid user guest 185.196.8.253 port 45384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:57:45 host2 sshd[3560965]: Disconnected from invalid user emo 185.196.8.253 port 44546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec 22 13:57:28 host2 sshd[3560745]: Disconnected from invalid user vpn 43.160.200.211 port 59766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 22 13:59:29 host2 sshd[3562628]: Disconnected from invalid user emo 66.154.125.60 port 43642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.152.250.192
country_id: 3469034
description:
Dec 22 14:00:11 host2 sshd[3563459]: Disconnected from invalid user yaraque 164.152.250.192 port 49616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.253
country_id: 2658434
description:
Dec 22 13:59:21 host2 sshd[3562493]: Disconnected from invalid user kevin 185.196.8.253 port 46496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 22 14:00:49 host2 sshd[3564088]: Disconnected from invalid user wj 202.157.177.161 port 58948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec 22 14:03:18 host2 sshd[3566580]: Disconnected from invalid user test 43.160.200.211 port 60028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 22 14:02:41 host2 sshd[3565873]: Disconnected from invalid user guest 202.157.177.161 port 37876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Dec 22 14:03:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.95, lip=66.85.158.91, TLS, session=<vql6RoZGju3G6xhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-22 14:03:04 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:35191: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-22 14:03:51 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:54842: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-22 14:06:22 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:57252: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-22 14:07:21 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:39026: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 22 14:08:50 host2 pure-ftpd[3572761]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-22 14:10:15 dovecot_login authenticator failed for H=([195.222.57.183]) [195.222.57.183]:37144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-22 14:10:27 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:37820: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:20 +0530] info [cpaneld] 197.144.55.53 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 197.144.55.53
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[197.144.55.53] [Remote Port]=[11044] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Mon Dec 22 08:58:25 2025 UTC/Mon Dec 22 14:28:25 2025 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:24 +0530] info [cpaneld] 197.144.55.53 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.144.55.53
country_id: 2542007
description:
[2025-12-22 14:13:30 +0530] info [cpaneld] 197.144.55.53 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-22 14:16:33 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:43846: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-22 14:16:50 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:34138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:19:23 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Y6H2gIZGWLsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-12-22 14:21:21 dovecot_login authenticator failed for H=([49.124.155.162]) [49.124.155.162]:51952: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-22 14:21:44 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:36118: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:21:55 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<hsMEioZGcJ4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:22:25 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ATLQi4ZG5t8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.6.176
country_id: 6252001
description:
Dec 22 14:24:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.22.6.176, lip=66.85.158.92, session=<XfKvkoZGwIilFgaw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:24:57 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<WtzklIZGkIsDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Dec 22 14:25:25 host2 sshd[3586237]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 58472


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:25:39 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jh1ll4ZG+JEDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:26:14 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nZJ4mYZGAKIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 22 14:26:49 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<156Im4ZGNIUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:32:38 dovecot_login authenticator failed for H=(vhYaAQ) [178.16.54.97]:61828: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:33:25 dovecot_login authenticator failed for H=(pod0z0T9j) [178.16.54.97]:57167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-22 14:34:35 dovecot_login authenticator failed for H=(2zxztRJX) [178.16.54.97]:58125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.120.137
country_id: 798544
description:
Dec 22 14:38:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.231.120.137, lip=66.85.158.91, TLS, session=<x3KfxIZGINFb53iJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.227
country_id: 3469034
description:
Dec 22 14:38:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=187.120.73.227, lip=66.85.158.91, TLS, session=<BeizxYZGi+C7eEnj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 14:41:45 host2 sshd[3599408]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 14:44:07 host2 pure-ftpd[3601317]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-22 14:49:38 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:40486: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-22 14:49:52 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:46268: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 14:51:56 host2 sshd[3608380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-22 14:55:29 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:60707: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-22 14:55:54 dovecot_login authenticator failed for H=71-208-122-185.ftmy.qwest.net [71.208.122.185]:56886: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.132
country_id: 6252001
description:
Dec 22 14:57:30 host2 pure-ftpd[3613133]: (?@64.62.156.132) [INFO] New connection from 64.62.156.132


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 14:57:54 host2 sshd[3613389]: Disconnected from invalid user ttt 185.196.11.247 port 60028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 14:59:44 host2 sshd[3614819]: Disconnected from invalid user mqm 103.187.165.26 port 35370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.216
country_id: 6252001
description:
Dec 22 15:01:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.216, lip=66.85.158.92, session=<megwGYdGTPrG6xjY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 15:02:26 host2 sshd[3616677]: Disconnected from invalid user yann 185.196.11.247 port 41884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 15:02:52 host2 sshd[3616928]: Disconnected from invalid user backups 103.187.165.26 port 51588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.247
country_id: 2658434
description:
Dec 22 15:02:56 host2 sshd[3616972]: Disconnected from invalid user andrew 185.196.11.247 port 60260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:03:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<NnB5IIdG1r8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-22 15:04:16 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:48882: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-22 15:03:46 dovecot_login authenticator failed for H=(201.173.216.16-clientes-izzi.mx) [201.173.216.16]:46153: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-22 15:04:26 dovecot_login authenticator failed for H=([93.121.175.220]) [93.121.175.220]:60224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-22 15:04:49 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50304: 535 Incorrect authentication data


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 22 15:04:53 host2 sshd[3618518]: Disconnected from invalid user webftp 103.187.165.26 port 53354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-22 15:05:18 dovecot_login authenticator failed for H=([172.82.64.201]) [172.82.64.201]:48908: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.5
country_id: 798544
description:
Dec 22 15:07:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=91.228.33.5, lip=66.85.158.91, TLS, session=<TCtnKodGWu1b5CEF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:06:21 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<yWfxKIdGDugDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:08:17 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<IU7UL4dG5tgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.154.139
country_id: 2782113
description:
Dec 22 15:07:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.255.154.139, lip=66.85.158.91, TLS, session=<6kSiK4dGh9pV/5qL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-22 15:07:52 dovecot_login authenticator failed for H=c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:32682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-22 15:08:11 dovecot_login authenticator failed for H=([46.210.94.61]) [46.210.94.61]:39118: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:09:10 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<mRH6ModG+OcDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-22 15:09:15 dovecot_login authenticator failed for H=([210.56.12.205]) [210.56.12.205]:39292: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:10:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<9pW3N4dGEuYDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:11:08 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<+dgOOodG3tcDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 15:12:26 host2 sshd[3624657]: Disconnected from invalid user user 2.57.121.25 port 46653 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:13:07 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<e7IfQYdG4KoDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:14:02 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<L8BrRIdGWpYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:13:24 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YTIsQodGEpYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-12-22 15:16:09 dovecot_login authenticator failed for H=([125.20.224.10]) [125.20.224.10]:41554: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 15:15:56 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<uUgxS4dGEKMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.72
country_id: 1733045
description:
2025-12-22 15:17:12 dovecot_login authenticator failed for H=([49.124.151.72]) [49.124.151.72]:55650: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-22 15:21:45 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:47540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 15:22:09 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:38183: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.124.206.113
country_id: 630336
description:
2025-12-22 15:24:01 dovecot_login authenticator failed for H=mm-113-206-124-178.static.mgts.by ([127.0.0.1]) [178.124.206.113]:33870: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2025-12-22 15:24:15 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.39]:38276: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.115.2.252
country_id: 6252001
description:
2025-12-22 15:25:46 dovecot_login authenticator failed for H=([127.0.0.1]) [172.115.2.252]:60842: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.49.162.33
country_id: 3686110
description:
2025-12-22 15:26:04 dovecot_login authenticator failed for H=([127.0.0.1]) [179.49.162.33]:59562: 535 Incorrect authentication data (set_id=chitral100)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-22 15:28:11 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:41190: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-22 15:28:27 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:39870: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-22 15:38:04 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:45276: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-22 15:38:26 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:49088: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 22 15:39:17 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, TLS, session=<IMa1nodGstNV2ZUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 22 15:39:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, TLS: Connection closed, session=<DZazn4dG3LtV2ZUU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:41:54 host2 sshd[3652619]: Disconnected from invalid user vmuser 34.142.110.144 port 34804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:43:01 host2 sshd[3653980]: Disconnected from invalid user test_user 34.142.110.144 port 58816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.192.98.140
country_id: 3469034
description:
Dec 22 15:42:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=200.192.98.140, lip=66.85.158.91, TLS, session=<V7AFqYdGBuzIwGKM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.233
country_id: 690791
description:
Dec 22 15:42:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.7.233, lip=66.85.158.91, TLS, session=<x5Q8qodGKdywZwfp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:44:20 host2 sshd[3655515]: Disconnected from invalid user ubuntu 172.172.130.40 port 49158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:43:29 host2 sshd[3654515]: Disconnected from invalid user user04 177.93.215.39 port 39228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.116.100
country_id: 3469034
description:
Dec 22 15:43:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.87.116.100, lip=66.85.158.91, TLS, session=<16l/rYdGwcKxV3Rk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.193.129.120
country_id: 6290252
description:
Dec 22 15:44:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=62.193.129.120, lip=66.85.158.91, TLS, session=<H5+urodGt9k+wYF4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Dec 22 15:44:05 host2 sshd[3655254]: Disconnected from invalid user ceshi 34.142.110.144 port 54596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:45:21 host2 sshd[3657177]: Disconnected from invalid user admin 177.93.215.39 port 34822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:46:07 host2 sshd[3657717]: Disconnected from invalid user user04 177.93.215.39 port 46310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 15:46:15 host2 sshd[3657806]: Disconnected from invalid user user 2.57.121.25 port 23964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-22 15:45:28 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:49498: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-22 15:45:43 dovecot_login authenticator failed for H=([196.190.43.139]) [196.190.41.137]:39438: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 15:46:33 host2 pure-ftpd[3658022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.93.215.39
country_id: 3469034
description:
Dec 22 15:47:34 host2 sshd[3658750]: Disconnected from invalid user chatbot 177.93.215.39 port 41050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:48:11 host2 sshd[3659130]: Disconnected from invalid user pm2 35.231.227.246 port 33788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 22 15:48:37 host2 sshd[3659419]: Disconnected from invalid user samp 43.133.148.170 port 36110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:49:00 host2 sshd[3659674]: Disconnected from invalid user june 172.172.130.40 port 37780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:49:37 host2 sshd[3660123]: Disconnected from invalid user awx 35.231.227.246 port 55426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-22 15:51:01 dovecot_login authenticator failed for H=([121.73.169.153]) [121.73.169.153]:37370: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.231.227.246
country_id: 6252001
description:
Dec 22 15:51:03 host2 sshd[3661472]: Disconnected from invalid user minecraft 35.231.227.246 port 35782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 15:51:14 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:60586: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 22 15:50:29 host2 sshd[3661052]: Disconnected from invalid user user1 43.133.148.170 port 50440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.115.56.44
country_id: 3686110
description:
Dec 22 15:51:25 host2 sshd[3661710]: Disconnected from invalid user debian 186.115.56.44 port 49744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Dec 22 15:52:00 host2 sshd[3662048]: Disconnected from invalid user samp 172.172.130.40 port 34484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.115.56.44
country_id: 3686110
description:
Dec 22 15:52:45 host2 sshd[3662533]: Disconnected from invalid user june 186.115.56.44 port 49228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-22 15:55:11 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:44789: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-22 15:55:31 dovecot_login authenticator failed for H=([187.252.170.147]) [187.252.170.147]:42286: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-22 15:55:49 dovecot_login authenticator failed for H=(189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:55468: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:01:12 host2 sshd[3669622]: Disconnected from invalid user tempuser 107.150.110.167 port 40864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:02:22 host2 sshd[3670260]: Disconnected from invalid user ociistst 107.150.110.167 port 10656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 22 16:03:42 host2 sshd[3671130]: Disconnected from invalid user intell 167.99.49.89 port 39588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.236.85.34
country_id: 3469034
description:
Dec 22 16:03:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=45.236.85.34, lip=66.85.158.91, TLS, session=<DUNo9YdGS5At7FUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.111
country_id: 3175395
description:
Dec 22 16:03:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.197.8.111, lip=66.85.158.91, TLS, session=<iPxD9IdG9dW5xQhv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:04:43 host2 sshd[3671674]: Disconnected from invalid user ftpadmin 36.78.222.219 port 46968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 22 16:05:43 host2 sshd[3672475]: Disconnected from invalid user pms 89.107.10.66 port 41236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:05:47 host2 sshd[3672524]: Disconnected from invalid user ubuntu 107.150.110.167 port 30036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:07:10 host2 sshd[3673197]: Disconnected from invalid user eas 36.78.222.219 port 49282 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 22 16:07:22 host2 sshd[3673318]: Received disconnect from 107.150.110.167 port 12218:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:07:55 host2 sshd[3673643]: Disconnected from invalid user pro 36.78.222.219 port 32974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Dec 22 16:08:33 host2 sshd[3674527]: Disconnected from invalid user jens 89.107.10.66 port 50554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.78.222.219
country_id: 1643084
description:
Dec 22 16:08:46 host2 sshd[3674677]: Disconnected from invalid user webftp 36.78.222.219 port 41830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 22 16:09:39 host2 sshd[3675284]: Disconnected from invalid user db2inst1 103.100.211.35 port 57052 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.71.161.171
country_id: 6252001
description:
Dec 22 16:11:06 host2 pure-ftpd[3676675]: (?@167.71.161.171) [INFO] New connection from 167.71.161.171


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:16:51 host2 sshd[3682421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:18:22 host2 sshd[3683433]: Disconnected from invalid user admin 108.173.137.12 port 51096 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:20:07 host2 sshd[3684863]: Disconnected from invalid user postgres 108.173.137.12 port 41124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 22 16:20:42 host2 sshd[3685368]: Disconnected from invalid user alice 108.173.137.12 port 56816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 22 16:20:48 host2 sshd[3685414]: Disconnected from invalid user ubnt 101.36.108.134 port 46132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 22 16:21:22 host2 sshd[3685816]: Disconnected from invalid user bot2 101.36.108.134 port 43634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 22 16:22:59 host2 sshd[3686872]: Disconnected from invalid user webapps 103.172.205.208 port 49978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-22 16:25:14 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:54718: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-12-22 16:25:36 dovecot_login authenticator failed for H=([37.142.173.63]) [37.142.173.63]:55896: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:26:48 host2 sshd[3689702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 22 16:28:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<fkfDTohGVNUs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 16:29:59 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61427: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 22 16:30:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS handshaking: Connection closed, session=<h31xVYhG/EdChJmI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 22 16:32:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VI7oW4hGkodChJlw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:32:50 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<rxo6XohGgpDPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:32:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<M009XohGipDPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-22 16:33:57 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-22 16:34:26 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:44368: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-12-22 16:35:09 dovecot_login authenticator failed for H=([182.95.46.178]) [182.95.46.178]:52296: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 16:37:01 host2 sshd[3697756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.9
country_id: 6252001
description:
Dec 22 16:37:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.9, lip=66.85.158.91, session=<ocnPbYhGmOkUqWkJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-22 16:38:13 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:35676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-22 16:37:24 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:50354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-22 16:37:39 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:38514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-22 16:38:34 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:60288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-22 16:41:16 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:61126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-12-22 16:41:32 dovecot_login authenticator failed for H=(49.207.9.39.actcorp.in) [49.207.9.39]:59822: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 16:43:05 host2 sshd[3702282]: Disconnected from invalid user admin 2.57.121.112 port 17667 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.226
country_id: 6252001
description:
Dec 22 16:43:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.174.226, lip=66.85.158.92, session=<XZl3hYhGXKIofK7i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.206
country_id: 6252001
description:
Dec 22 16:45:22 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qlcKi4hGCz9APpzO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Dec 22 16:45:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hHMGjIhGQp7Y2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Dec 22 16:45:40 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ryAjjIhGrCVAPpzK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 16:48:59 host2 pure-ftpd[3707180]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:51:43 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<XQO+oYhGptTPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 22 16:51:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<oyjFoYhGstTPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-22 17:08:22 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:44768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-22 17:08:53 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:50022: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2025-12-22 17:09:23 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:53749: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-22 17:10:12 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:36392: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-22 17:10:12 dovecot_login authenticator failed for H=([191.217.23.65]) [187.6.121.246]:37285: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.81
country_id: 3996063
description:
2025-12-22 17:10:31 dovecot_login authenticator failed for H=([177.236.144.81]) [177.236.144.81]:38360: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-22 17:10:28 dovecot_login authenticator failed for H=([182.160.107.51]) [182.160.107.51]:43622: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-22 17:12:11 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:49086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-22 17:12:26 dovecot_login authenticator failed for H=([125.19.154.158]) [125.19.154.158]:56350: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:12:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9EEp7YhG5pEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:14:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AapW84hGVsIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:16:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<XYvk+IhG5rMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 17:16:19 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:58963: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-22 17:15:23 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:50414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-12-22 17:15:40 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:47131: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:16:54 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<cQbV+4hGIuADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.106
country_id: 3469034
description:
Dec 22 17:17:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.44.96.106, lip=66.85.158.91, TLS, session=<5ZR++4hGZN+xLGBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 22 17:16:40 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<VUn9+ohGUMk2xDDo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.30
country_id: 1269750
description:
Dec 22 17:16:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.164.246.30, lip=66.85.158.91, TLS, session=<H1JI+ohGSe1npPYe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 17:17:53 host2 sshd[3730456]: Disconnected from invalid user admin 2.57.121.112 port 29641 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:18:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<7ds4AYlGstsDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:19:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pThmBYlGduIDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2025-12-22 17:19:49 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us ([127.0.0.1]) [51.81.211.221]:41028: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.28
country_id: 3996063
description:
2025-12-22 17:20:13 dovecot_login authenticator failed for H=([127.0.0.1]) [201.173.216.28]:47259: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 22 17:20:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<KP1kCIlGgOo26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:21:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7mXEColGouEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 22 17:22:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<bOYLD4lG2ucDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.203
country_id: 1269750
description:
Dec 22 17:21:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.164.246.203, lip=66.85.158.91, TLS, session=<e717C4lG4u1npPbL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.234
country_id: 732800
description:
Dec 22 17:21:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.255.212.234, lip=66.85.158.91, TLS, session=<xWmpDIlGVai5/9Tq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 17:51:40 host2 pure-ftpd[3760432]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 17:52:47 host2 sshd[3760991]: Disconnected from invalid user admin 2.57.121.112 port 9364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-22 17:55:55 dovecot_login authenticator failed for H=(abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:48539: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-22 17:56:14 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:36651: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 18:00:51 host2 sshd[3768254]: Disconnected from invalid user user 2.57.121.25 port 30385 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-12-22 18:02:10 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:52328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-22 18:02:30 dovecot_login authenticator failed for H=([177.236.146.168]) [177.236.146.168]:60340: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 18:03:53 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:51546: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-22 18:05:46 dovecot_login authenticator failed for H=(nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:54738: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-22 18:06:11 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65517: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 18:08:09 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:58844: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 18:11:39 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:56984: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-12-22 18:11:41 dovecot_login authenticator failed for H=c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:48802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-12-22 18:12:08 dovecot_login authenticator failed for H=([95.35.29.192]) [95.35.29.192]:45167: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-22 18:13:17 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:58386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-22 18:13:35 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:55525: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 18:14:14 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:48054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:15:04 host2 sshd[3780708]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-22 18:14:42 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:59854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:14:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:51824: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:17:15 host2 sshd[3782853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 18:18:28 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:38522: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:20:54 host2 sshd[3786677]: Disconnected from invalid user oracle 107.155.55.174 port 39106 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:21:54 host2 sshd[3787639]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-22 18:21:25 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au ([127.0.0.1]) [194.223.20.191]:37881: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.109.101
country_id: 3144096
description:
2025-12-22 18:21:32 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.109.101]:38713: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:21:29 host2 sshd[3787245]: Disconnected from invalid user ubuntu 20.123.120.169 port 38204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:21:34 host2 sshd[3787319]: Disconnected from invalid user splunk 107.155.55.174 port 52672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:21:35 host2 sshd[3787343]: Disconnected from invalid user cyber 189.47.10.63 port 40000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 18:21:59 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:60514: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:22:54 host2 sshd[3788604]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 18:22:56 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:46354: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Dec 22 18:23:37 host2 sshd[3789393]: Disconnected from invalid user ubuntu 107.155.55.174 port 36906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:23:43 host2 sshd[3789534]: Disconnected from invalid user wx 189.47.10.63 port 44834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:23:46 host2 sshd[3789574]: Disconnected from invalid user app 20.123.120.169 port 47570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.63
country_id: 3469034
description:
Dec 22 18:24:41 host2 sshd[3790560]: Disconnected from invalid user rr 189.47.10.63 port 56218 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:25:34 host2 sshd[3791773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:25:31 host2 sshd[3791729]: Disconnected from invalid user oracle 20.123.120.169 port 54098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 18:25:59 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:45542: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 22 18:27:16 host2 sshd[3793463]: Disconnected from invalid user user 20.123.120.169 port 58086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-22 18:27:23 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:36258: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 18:27:29 host2 sshd[3793655]: Disconnected from invalid user admin 2.57.121.112 port 32215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-22 18:28:02 dovecot_login authenticator failed for H=(static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:49825: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 18:30:20 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:34852: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.49
country_id: 798544
description:
Dec 22 18:34:11 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.33.49, lip=66.85.158.91, TLS, session=<HKQ+D4pGXghb5CEx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 18:34:13 host2 sshd[3800354]: Disconnected from invalid user user 2.57.121.25 port 10581 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.187.48.82
country_id: 130758
description:
Dec 22 18:34:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=185.187.48.82, lip=66.85.158.91, TLS, session=<ePxTEIpGfqm5uzBS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 18:38:09 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:31440: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.96
country_id: 3175395
description:
Dec 22 18:39:07 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info>, method=PLAIN, rip=185.15.171.96, lip=66.85.158.91, TLS, session=<jE2mIYpGkNe5D6tg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 18:38:32 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:1233: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.89
country_id: 798544
description:
Dec 22 18:38:49 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=178.216.29.89, lip=66.85.158.91, TLS, session=</evGH4pGrISy2B1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 18:39:01 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:42656: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.234
country_id: 2963597
description:
Dec 22 18:39:02 host2 dovecot[1601669]: imap-login: Disconnected: Shutting down (auth failed, 3 attempts in 11 secs): user=<info>, method=PLAIN, rip=89.106.141.234, lip=66.85.158.91, session=<DMHfIIpG9OFZao3q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:40:28 host2 sshd[3806283]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 18:43:23 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:52216: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:45:14 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:52810: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 18:45:22 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:41406: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:48:15 host2 sshd[3813677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 18:48:48 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:36506: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 18:49:15 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:49704: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 18:50:03 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:36500: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 18:50:49 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:36968: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-22 18:53:13 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:48138: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 18:53:33 host2 sshd[3818021]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.244.206.6
country_id: 1643084
description:
2025-12-22 18:53:38 dovecot_plain authenticator failed for H=(localhost) [103.244.206.6]:44666: 535 Incorrect authentication data (set_id=sales@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-22 18:53:56 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:54250: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-22 18:54:11 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:44542: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-12-22 18:54:31 dovecot_login authenticator failed for H=107.93.206.77.rev.sfr.net [77.206.93.107]:45716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 18:54:32 host2 pure-ftpd[3819149]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 18:54:36 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:40786: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-22 18:54:49 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:42421: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-12-22 18:56:17 dovecot_login authenticator failed for H=([203.124.44.231]) [203.124.44.231]:42264: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 18:56:40 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:53980: 535 Incorrect authentication data (set_id=sales@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 18:59:25 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:39990: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:01:10 host2 sshd[3824303]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:00:38 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:44692: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:01:08 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:59556: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:01:16 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:39252: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.234.135.110
country_id: 2635167
description:
2025-12-22 19:01:20 dovecot_plain authenticator failed for H=vps.neovantas.com (localhost) [85.234.135.110]:45126: 535 Incorrect authentication data (set_id=info@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 19:01:41 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:57396: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 19:04:05 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:52966: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 217.125.83.165
country_id: 2510769
description:
Dec 22 19:05:05 host2 sshd[3827336]: Disconnected from invalid user ftpuser 217.125.83.165 port 40401 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.125.83.165
country_id: 2510769
description:
Dec 22 19:06:21 host2 sshd[3828483]: Disconnected from invalid user admin 217.125.83.165 port 64595 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 19:09:33 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:39990: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 19:10:44 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:55718: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 22 19:11:00 host2 sshd[3833093]: Disconnected from invalid user developer 152.32.203.205 port 59982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 22 19:12:09 host2 sshd[3834106]: Disconnected from invalid user postgres 154.91.81.224 port 36862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 22 19:13:23 host2 sshd[3835437]: Disconnected from invalid user user1 152.32.203.205 port 38200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:14:41 host2 sshd[3836494]: Disconnected from invalid user sysuser 152.32.130.118 port 42842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 19:15:04 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:54626: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 22 19:15:04 host2 sshd[3836964]: Disconnected from invalid user deployroot 154.91.81.224 port 33794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 19:14:17 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:57778: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 19:16:33 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<L+adp4pGlMLBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:16:47 host2 sshd[3838613]: Disconnected from invalid user element 138.99.80.102 port 37480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:17:29 host2 sshd[3839165]: Disconnected from invalid user user1 138.99.80.102 port 42528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 19:17:43 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:53820: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 22 19:18:43 host2 sshd[3840153]: Disconnected from invalid user apache 138.99.80.102 port 55236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.94
country_id: 3175395
description:
Dec 22 19:18:57 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.94, lip=66.85.158.91, TLS, session=<64Yyr4pGl9u5D6le>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.222
country_id: 3175395
description:
Dec 22 19:19:23 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=185.15.169.222, lip=66.85.158.91, TLS, session=<376FsIpGeLy5D6ne>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:19:43 host2 sshd[3840945]: Disconnected from invalid user gitlab 152.32.130.118 port 59374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 22 19:20:22 host2 sshd[3841643]: Disconnected from invalid user git 152.32.130.118 port 36938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-22 19:21:05 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:59948: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:21:49 host2 sshd[3842744]: Disconnected from invalid user account 185.141.132.26 port 49994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 19:23:30 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:54982: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:23:34 host2 sshd[3843894]: Disconnected from invalid user admin 185.141.132.26 port 47698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:23:46 host2 sshd[3843971]: Disconnected from invalid user admin 206.189.130.118 port 57684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:24:07 host2 sshd[3844206]: Disconnected from invalid user user 185.141.132.26 port 45666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:24:24 host2 sshd[3844376]: Disconnected from invalid user account 206.189.130.118 port 45884 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 22 19:24:29 host2 pure-ftpd[3844449]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:24:43 host2 sshd[3844558]: Disconnected from invalid user ubuntu 185.141.132.26 port 52920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec 22 19:26:21 host2 sshd[3846147]: Disconnected from invalid user frappe-user 185.141.132.26 port 44516 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 22 19:27:32 host2 sshd[3846927]: Disconnected from invalid user xue 206.189.130.118 port 47468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 19:27:42 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:48758: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-22 19:29:02 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:50650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Dec 22 19:29:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.22, lip=66.85.158.91, TLS: Connection closed, session=<oLje1opGZsJV2ZUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-22 19:29:41 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:33002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 22 19:31:11 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<jMEQ3IpG8s5HBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 22 19:31:16 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GBlX3IpGlNVHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 19:31:46 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:60932: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2025-12-22 19:31:57 dovecot_login authenticator failed for H=([127.0.0.1]) [61.0.228.11]:39184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.16.201.242
country_id: 3996063
description:
2025-12-22 19:32:05 dovecot_login authenticator failed for H=([127.0.0.1]) [159.16.201.242]:36155: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 19:32:14 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:52690: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 19:32:20 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:55716: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 19:35:04 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:39092: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:37:09 host2 sshd[3854537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 19:39:35 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:57624: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-22 19:43:39 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:37607: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-22 19:43:51 dovecot_login authenticator failed for H=200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:40300: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-22 19:45:31 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:34511: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 19:45:45 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:46346: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-22 19:45:50 dovecot_login authenticator failed for H=host-24-222-149-239.public.eastlink.ca [24.222.149.239]:60785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-12-22 19:47:11 dovecot_login authenticator failed for H=(74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:40653: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 19:47:14 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:37016: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 19:47:27 host2 sshd[3864956]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 19:47:40 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:10130: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 19:47:20 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:17510: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-22 19:47:41 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:34308: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 19:48:28 host2 sshd[3865771]: Disconnected from invalid user  62.60.131.157 port 56084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 19:53:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:58056: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-22 19:56:30 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60876: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.241.224
country_id: 798544
description:
Dec 22 19:57:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.125.241.224, lip=66.85.158.91, TLS, session=<oP1bOItGg5htffHg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 19:57:27 host2 pure-ftpd[3873791]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.107
country_id: 3469034
description:
Dec 22 19:57:36 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.137.107, lip=66.85.158.91, TLS, session=<LnV6OYtGCaO+WYlr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 19:57:46 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:34056: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:59:12 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:43476: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 19:59:10 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:59339: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 19:59:18 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:50424: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 19:59:49 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:51276: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 20:04:20 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:41070: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 22 20:05:00 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dB36VItGurBChJl2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 20:05:31 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:57744: 535 Incorrect authentication data (set_id=sales@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 20:09:40 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:55904: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 20:10:02 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:47852: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 20:10:42 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:34980: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-22 20:13:12 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:58478: 535 Incorrect authentication data (set_id=support@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 20:12:16 host2 sshd[3884788]: Disconnected from invalid user  62.60.131.157 port 41848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:12:20 host2 sshd[3884836]: Disconnected from invalid user eas 39.109.104.252 port 55942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:14:00 host2 sshd[3885788]: Disconnected from invalid user transfer 39.109.104.252 port 52714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:14:46 host2 sshd[3886242]: Disconnected from invalid user elasticsearch 39.109.104.252 port 36892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Dec 22 20:15:38 host2 sshd[3886900]: Disconnected from invalid user ansible 39.109.104.252 port 49544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 20:17:30 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:56712: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:22:36 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:37268: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-22 20:23:12 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:63160: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-22 20:23:52 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:43628: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.71.237.17
country_id: 2635167
description:
2025-12-22 20:27:00 dovecot_plain authenticator failed for H=li666-17.members.linode.com (localhost) [212.71.237.17]:49870: 535 Incorrect authentication data (set_id=admin@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 20:26:35 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:7398: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 20:28:05 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:51082: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 20:28:41 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:56712: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-22 20:28:47 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:60798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.38
country_id: 3996063
description:
2025-12-22 20:29:03 dovecot_login authenticator failed for H=(187.161.136.38-clientes-izzi.mx) [187.161.136.38]:59305: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 20:29:26 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:34996: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:34:08 host2 sshd[3900474]: Disconnected from invalid user deploy 20.127.224.153 port 52844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:34:36 host2 sshd[3900764]: Disconnected from invalid user reports 91.147.92.31 port 51170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 20:36:32 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:52922: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:37:12 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:42598: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 20:37:20 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:60448: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 20:37:58 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:46768: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:38:19 host2 sshd[3903557]: Disconnected from invalid user reports 20.127.224.153 port 39482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-22 20:38:36 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:44026: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 20:38:38 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:41628: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:38:52 host2 sshd[3903877]: Disconnected from invalid user dev 20.127.224.153 port 34952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.254
country_id: 2186224
description:
2025-12-22 20:39:05 dovecot_login authenticator failed for H=([121.73.163.254]) [121.73.163.254]:44972: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-12-22 20:39:22 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:35074: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-22 20:39:49 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:33137: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:40:09 host2 sshd[3904783]: Disconnected from invalid user jy 91.147.92.31 port 54850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Dec 22 20:40:34 host2 sshd[3905110]: Disconnected from invalid user willem 20.127.224.153 port 39582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.245.170
country_id: 3469034
description:
2025-12-22 20:42:03 dovecot_login authenticator failed for H=([127.0.0.1]) [187.76.245.170]:37142: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:42:05 host2 sshd[3906311]: Disconnected from invalid user uat 91.147.92.31 port 57332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 22 20:41:51 host2 sshd[3906130]: Disconnected from invalid user ocean 103.164.9.82 port 60658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2025-12-22 20:42:16 dovecot_login authenticator failed for H=([127.0.0.1]) [128.185.225.186]:54360: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 22 20:42:34 host2 sshd[3906602]: Disconnected from invalid user soporte 103.164.9.82 port 56844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Dec 22 20:42:46 host2 sshd[3906723]: Disconnected from invalid user debian 91.147.92.31 port 58126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:42:58 host2 sshd[3906879]: Disconnected from invalid user indico 12.156.67.18 port 60032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 20:43:09 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:56246: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 20:43:16 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:8642: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:43:31 host2 sshd[3907277]: Disconnected from invalid user den 12.156.67.18 port 40854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:44:39 host2 sshd[3908039]: Disconnected from invalid user roberto 12.156.67.18 port 37624 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.131.177.75
country_id: 6252001
description:
Dec 22 20:45:45 host2 pure-ftpd[3909053]: (?@104.131.177.75) [INFO] New connection from 104.131.177.75


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.76.155.134
country_id: 1819730
description:
2025-12-22 20:45:56 dovecot_plain authenticator failed for H=(localhost) [47.76.155.134]:48914: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:46:13 host2 sshd[3909739]: Disconnected from invalid user temp 12.156.67.18 port 60218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:47:30 host2 sshd[3910747]: Disconnected from invalid user tp 157.230.211.219 port 42592 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:47:47 host2 sshd[3911010]: Received disconnect from 12.156.67.18 port 49948:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:48:11 host2 sshd[3911298]: Disconnected from invalid user user 157.230.211.219 port 52330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.165
country_id: 99237
description:
Dec 22 20:49:09 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=65.20.205.165, lip=66.85.158.91, TLS, session=<eajY8YtG49pBFM2l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 22 20:48:20 host2 sshd[3911422]: Disconnected from invalid user ocean 12.156.67.18 port 51386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.111.103
country_id: 798544
description:
Dec 22 20:49:28 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=91.196.111.103, lip=66.85.158.91, TLS, session=<eMDy8otGx7tbxG9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 20:50:27 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33012: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:53:28 host2 sshd[3915445]: Disconnected from invalid user development 104.223.85.124 port 35058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.181.6
country_id: 3865483
description:
Dec 22 20:53:44 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=190.110.181.6, lip=66.85.158.91, TLS, session=<of4qAoxGE6q+brUG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.36
country_id: 99237
description:
Dec 22 20:54:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=65.20.129.36, lip=66.85.158.91, TLS, session=<EEFlA4xGbItBFIEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-22 20:55:15 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:59392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 20:56:08 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:50322: 535 Incorrect authentication data (set_id=sales@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:55:39 host2 sshd[3917961]: Disconnected from invalid user ocean 157.230.211.219 port 41542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:56:29 host2 sshd[3918663]: Disconnected from invalid user user 104.223.85.124 port 52672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-22 20:56:48 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:51466: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:57:05 host2 sshd[3919127]: Disconnected from invalid user ftpUser 104.223.85.124 port 58820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 22 20:57:38 host2 sshd[3919489]: Disconnected from invalid user mark 104.223.85.124 port 37442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 22 20:57:18 host2 sshd[3919284]: Disconnected from invalid user den 157.230.211.219 port 39982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 20:58:43 host2 sshd[3920264]: Disconnected from invalid user dockeruser 152.32.191.75 port 37134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 22 20:59:36 host2 sshd[3920834]: Disconnected from invalid user ftp_user 103.153.190.105 port 43066 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 21:00:24 host2 pure-ftpd[3921664]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 21:01:50 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:35088: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:02:26 host2 sshd[3923142]: Disconnected from invalid user web 152.32.191.75 port 38288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:03:42 host2 sshd[3924324]: Disconnected from invalid user ftpuser 152.32.191.75 port 39926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 21:04:08 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:47404: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 22 21:04:20 host2 sshd[3924828]: Disconnected from invalid user postgres 152.32.191.75 port 44510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-22 21:04:31 dovecot_login authenticator failed for H=(static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:35570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-12-22 21:04:58 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:39537: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 21:06:41 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:58690: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 22 21:07:37 host2 sshd[3927345]: Disconnected from invalid user guest 103.153.190.105 port 41903 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 22 21:09:57 host2 pure-ftpd[3928940]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 21:12:13 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:48290: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-22 21:14:00 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:45289: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.232
country_id: 6252001
description:
Dec 22 21:14:42 host2 pure-ftpd[3933407]: (?@198.235.24.232) [INFO] New connection from 198.235.24.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 21:14:51 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:43652: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.142.119
country_id: 690791
description:
Dec 22 21:20:16 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=37.221.142.119, lip=66.85.158.91, TLS, session=<wPcuYIxGXocl3Y53>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 159.255.144.35
country_id: 3175395
description:
Dec 22 21:20:34 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=159.255.144.35, lip=66.85.158.91, TLS, session=<ejAxYoxGCbaf/5Aj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 21:23:19 host2 sshd[3942721]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.121
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.121: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:24:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SK2ocYxGItyi2JW3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:25:23 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<xs51dIxGlPui2JW3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 21:26:16 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:42146: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 21:26:22 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:42654: 535 Incorrect authentication data (set_id=contact@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-22 21:27:09 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:39086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2025-12-22 21:28:00 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:39734: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-22 21:30:00 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:33966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 21:30:19 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:49320: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 21:30:27 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:39290: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 21:31:23 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:54828: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.47.74
country_id: 2750405
description:
Dec 22 21:31:55 host2 pure-ftpd[3951616]: (?@167.172.47.74) [INFO] New connection from 167.172.47.74


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.183
country_id: 6252001
description:
Dec 22 21:32:30 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.183, lip=66.85.158.91, TLS, session=<uFLijYxGpO2i2JW3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 21:32:41 host2 sshd[3952274]: Disconnected from invalid user  62.60.131.157 port 20327 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 21:33:36 host2 sshd[3953565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 21:37:14 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:39040: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 21:37:24 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:38154: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 21:37:39 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:2627: 535 Incorrect authentication data (set_id=support@seyawin.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 21:38:42 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:1302: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 21:39:52 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:49780: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec 22 21:39:54 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, session=<LWFnqIxGLi+nXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-22 21:42:28 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:52740: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.205.71
country_id: 1605651
description:
2025-12-22 21:43:21 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.175.205.71]:59403: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-22 21:45:59 dovecot_login authenticator failed for H=210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:39141: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-22 21:46:11 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:47171: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:49:21 host2 sshd[3991365]: Disconnected from invalid user ftpuser1 152.42.231.101 port 52018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:49:35 host2 sshd[3991533]: Disconnected from invalid user admin 49.228.105.174 port 40026 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:54:18 host2 sshd[3996111]: Disconnected from invalid user esuser 152.42.231.101 port 59584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:53:31 host2 sshd[3994769]: Disconnected from invalid user sap_user 152.42.231.101 port 57668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec 22 21:55:03 host2 sshd[3996719]: Disconnected from invalid user ftpuser 152.42.231.101 port 57158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:56:04 host2 sshd[3997792]: Disconnected from invalid user ubuntu 49.228.105.174 port 56658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-22 21:56:05 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:10244: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-22 21:56:30 dovecot_login authenticator failed for H=([182.74.12.86]) [182.74.12.86]:36112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 21:57:23 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:53286: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-22 21:57:24 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:41686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 21:57:40 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:55382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.14.65
country_id: 2464461
description:
[2025-12-22 21:58:54 +0530] info [cpaneld] 196.178.14.65 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.178.14.65
country_id: 2464461
description:
Dec 22 21:58:53 host2 sshd[3999917]: Invalid user cloudtourssrilan_travel from 196.178.14.65 port 54823


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.105.174
country_id: 1605651
description:
Dec 22 21:59:10 host2 sshd[4000168]: Disconnected from invalid user TestUser 49.228.105.174 port 51374 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-22 21:59:24 +0530] info [cpaneld] 159.223.46.235 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec 22 22:03:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<Nbox+4xGko9ChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:03:12 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:45460: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 22:03:22 host2 pure-ftpd[4003609]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.66
country_id: 3996063
description:
Dec 22 22:04:00 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=138.122.97.66, lip=66.85.158.91, TLS, session=<sDZg/YxGWIOKemFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.194.113
country_id: 3865483
description:
Dec 22 22:04:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan>, method=PLAIN, rip=186.96.194.113, lip=66.85.158.91, TLS, session=<VPW5/oxG4eq6YMJx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 22:07:17 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:57300: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-22 22:10:04 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:37330: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-22 22:10:33 dovecot_login authenticator failed for H=([152.52.231.202]) [152.52.231.202]:47964: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:10:54 host2 sshd[4010007]: Disconnected from invalid user ron 58.153.142.234 port 4398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 22:11:14 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:36478: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 22:11:47 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:36020: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.238
country_id: 6252001
description:
Dec 22 22:12:27 host2 pure-ftpd[4011403]: (?@198.235.24.238) [INFO] New connection from 198.235.24.238


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:14:55 host2 sshd[4013924]: Disconnected from invalid user nelson 58.153.142.234 port 57358 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-22 22:14:45 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 22 22:14:48 host2 sshd[4013814]: Disconnected from invalid user celia 83.142.209.191 port 40408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.153.142.234
country_id: 1819730
description:
Dec 22 22:16:14 host2 sshd[4015122]: Disconnected from invalid user richard 58.153.142.234 port 35146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.163
country_id: 3017382
description:
Dec 22 22:16:38 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.163, lip=66.85.158.91, session=<FGTBK41Gi61bxJij>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Dec 22 22:16:50 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.145, lip=66.85.158.91, session=<+VVyLI1G/dRbxJiR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.146
country_id: 3017382
description:
Dec 22 22:17:01 host2 dovecot[3805015]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.146, lip=66.85.158.91, session=<RDsdLY1Ge+VbxJiS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.151
country_id: 3017382
description:
Dec 22 22:17:04 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.151, lip=66.85.158.91, session=<Xb9PLY1GQYZbxJiX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 22:19:28 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:33710: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-22 22:24:43 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:50580: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-22 22:25:10 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:58575: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 22:25:25 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:41448: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.159.244.132
country_id: 6252001
description:
Dec 22 22:25:56 host2 pure-ftpd[4024301]: (?@54.159.244.132) [INFO] New connection from 54.159.244.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 22:27:11 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:42708: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 22:26:57 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:58598: 535 Incorrect authentication data (set_id=help@sobaherbal.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:27:54 host2 sshd[4025804]: Disconnected from invalid user boss 103.55.36.22 port 38432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-22 22:32:17 dovecot_login authenticator failed for H=([120.157.13.61]) [120.157.13.61]:33352: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.205.235.254
country_id: 2802361
description:
Dec 22 22:31:41 host2 pure-ftpd[4029649]: (?@35.205.235.254) [INFO] New connection from 35.205.235.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-22 22:32:37 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56330: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:16 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:53166: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 22:33:25 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:39484: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:35:25 host2 sshd[4032935]: Disconnected from invalid user webuser 103.55.36.22 port 48836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:37:38 host2 sshd[4034737]: Disconnected from invalid user reza 103.55.36.22 port 38168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-22 22:37:55 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:42146: 535 Incorrect authentication data (set_id=support@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-22 22:37:23 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:42768: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-22 22:37:36 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:42476: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.230
country_id: 6252001
description:
Dec 22 22:38:50 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.230, lip=66.85.158.92, session=<6pYme41G7btBMQHm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:38:58 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:52856: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 22 22:39:02 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, TLS: Connection closed, session=<9sPZe41GCA5BMQHe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec 22 22:38:23 host2 sshd[4035377]: Disconnected from invalid user samuel 103.55.36.22 port 53616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 22 22:45:36 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.92, session=<HPVWk41GzOhV2YwR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.79.233.136
country_id: 1880251
description:
2025-12-22 22:45:46 dovecot_plain authenticator failed for H=(localhost) [47.79.233.136]:35974: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 22:48:54 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36348: 535 Incorrect authentication data (set_id=hr@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 22:49:30 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:57932: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 22:49:49 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:48672: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.193.17
country_id: 2750405
description:
Dec 22 22:51:42 host2 pure-ftpd[4047677]: (?@159.65.193.17) [INFO] New connection from 159.65.193.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:51:35 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:44394: 535 Incorrect authentication data (set_id=hr@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-22 22:53:15 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:35894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-22 22:53:00 dovecot_login authenticator failed for H=([182.95.181.62]) [182.95.181.62]:47010: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.24
country_id: 690791
description:
Dec 22 22:55:32 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=194.44.140.24, lip=66.85.158.91, TLS, session=</yzntY1GZubCLIwY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.93
country_id: 1269750
description:
Dec 22 22:55:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.8.118.93, lip=66.85.158.91, TLS, session=<0qwDt41G8ulnCHZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.128.27.123
country_id: 1880251
description:
2025-12-22 22:57:26 dovecot_plain authenticator failed for H=(localhost) [178.128.27.123]:51330: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.106.127
country_id: 1880251
description:
2025-12-22 22:59:06 dovecot_plain authenticator failed for H=(localhost) [134.209.106.127]:46636: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2025-12-22 22:59:16 dovecot_login authenticator failed for H=([127.0.0.1]) [45.38.0.41]:4361: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-22 22:59:25 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.230.142]:37630: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-22 23:00:46 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:41188: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-22 23:01:16 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:57608: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:01:27 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:51956: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 23:05:52 host2 pure-ftpd[4060237]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.118
country_id: 3865483
description:
Dec 22 23:07:08 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=45.238.107.118, lip=66.85.158.91, TLS, session=<OiE/341GOuEt7mt2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-22 23:06:27 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:8118: 535 Incorrect authentication data (set_id=admin@seyawin.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.100
country_id: 3175395
description:
Dec 22 23:07:26 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.169.100, lip=66.85.158.91, TLS, session=<ITtt4I1G0aW5D6lk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.135.19
country_id: 6252001
description:
[2025-12-22 23:07:32 +0530] info [webmaild] 192.111.135.19 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:09:05 host2 sshd[4062442]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.71.183.239
country_id: 6252001
description:
2025-12-22 23:08:37 dovecot_plain authenticator failed for H=(localhost) [167.71.183.239]:36068: 535 Incorrect authentication data (set_id=support@sivagnanamfoundation.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.226.210
country_id: 6252001
description:
[2025-12-22 23:09:00 +0530] info [webmaild] 142.54.226.210 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:22 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:46690: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.108.89.210
country_id: 3932488
description:
2025-12-22 23:09:29 dovecot_plain authenticator failed for H=(localhost) [190.108.89.210]:33544: 535 Incorrect authentication data (set_id=no-reply@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 128.185.192.138
country_id: 1269750
description:
[2025-12-22 23:11:03 +0530] info [webmaild] 128.185.192.138 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:15:35 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:38892: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.53.45.126
country_id: 1643084
description:
2025-12-22 23:15:44 dovecot_plain authenticator failed for H=(localhost) [117.53.45.126]:34042: 535 Incorrect authentication data (set_id=test@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-22 23:16:46 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:41894: 535 Incorrect authentication data (set_id=hr@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:18:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AzxICo5G/tsjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-22 23:19:06 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:38624: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 23:19:16 host2 sshd[4069611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-22 23:19:40 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:56406: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:19:46 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42624: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:19:49 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<grGyDY5Gzu0jy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-22 23:20:03 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:59488: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-22 23:19:26 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:44453: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-22 23:23:15 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:44080: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-12-22 23:23:45 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:56155: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.8.95
country_id: 6252001
description:
2025-12-22 23:23:46 dovecot_plain authenticator failed for H=(localhost) [167.99.8.95]:46036: 535 Incorrect authentication data (set_id=help@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-22 23:24:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:37992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-22 23:25:01 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:53252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.89
country_id: 2635167
description:
Dec 22 23:25:03 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.89, lip=66.85.158.92, TLS, session=<qrNuII5G+ugjy9JZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-22 23:29:05 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:52410: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.188
country_id: 6252001
description:
Dec 22 23:29:29 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.12.240.188, lip=66.85.158.92, session=<kpNEMI5GYpcUDPC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-22 23:31:48 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:34764: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.132.4.108
country_id: 3932488
description:
2025-12-22 23:34:26 dovecot_plain authenticator failed for H=(localhost) [161.132.4.108]:47264: 535 Incorrect authentication data (set_id=info@sobaherbal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-22 23:35:52 dovecot_login authenticator failed for H=([182.95.181.6]) [182.95.181.6]:49860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.232.203.22
country_id: 3017382
description:
2025-12-22 23:36:06 dovecot_login authenticator failed for H=([149.232.203.22]) [149.232.203.22]:60826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.65
country_id: 2542007
description:
2025-12-22 23:37:21 dovecot_login authenticator failed for H=([105.73.190.65]) [105.73.190.65]:38102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-22 23:37:40 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:47233: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.219.221.172
country_id: 2661886
description:
2025-12-22 23:39:49 dovecot_login authenticator failed for H=83-219-221-172.cust.bredband2.com ([127.0.0.1]) [83.219.221.172]:57020: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2025-12-22 23:40:20 dovecot_login authenticator failed for H=([127.0.0.1]) [216.132.40.41]:33082: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:41:13 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:32828: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-22 23:42:42 dovecot_plain authenticator failed for H=(localhost) [46.101.122.102]:49378: 535 Incorrect authentication data (set_id=no-reply@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-22 23:44:18 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:47470: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-22 23:44:35 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:37706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.95.31.158
country_id: 1605651
description:
2025-12-22 23:45:27 dovecot_plain authenticator failed for H=v150-95-31-158.a006.g.bkk1.static.cnode.io (localhost) [150.95.31.158]:40822: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.246.144
country_id: 6252001
description:
2025-12-22 23:51:40 dovecot_plain authenticator failed for H=(localhost) [47.89.246.144]:37198: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-22 23:53:52 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:4473: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.107
country_id: 6252001
description:
Dec 22 23:55:24 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.163.15.107, lip=66.85.158.91, session=<HZzujI5G1oAUow9r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 22 23:55:51 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<XayLjo5GetiLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-22 23:59:54 dovecot_login authenticator failed for H=([189.44.251.249]) [186.238.247.238]:40173: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-22 23:59:28 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:53712: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Dec 23 00:03:52 host2 dovecot[3805015]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.5.11, lip=66.85.158.92, session=<64Q8q45GKIItTwUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Dec 23 00:05:53 host2 dovecot[3805015]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7Zluso5G2khAPsUC>


