# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:49:30 host2 sshd[708307]: Disconnected from invalid user artifactory 45.61.149.143 port 49280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:48:55 host2 sshd[707922]: Disconnected from invalid user sa 152.32.129.236 port 44144 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 02:49:35 host2 sshd[708374]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:50:08 host2 sshd[708858]: Disconnected from invalid user elastic 45.61.149.143 port 56482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:51:12 host2 sshd[709749]: Disconnected from invalid user alertmanager 103.183.74.205 port 58372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:51:27 host2 sshd[709983]: Disconnected from invalid user gitea 161.248.201.228 port 49468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:15 host2 sshd[710562]: Disconnected from invalid user prometheus 66.154.117.138 port 48078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:52:37 host2 sshd[710794]: Disconnected from invalid user hikvision 152.32.129.236 port 58364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:42 host2 sshd[710862]: Disconnected from invalid user super 66.154.117.138 port 34128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.179.145.192
country_id: 2635167
description:
2026-01-15 02:52:52 dovecot_login authenticator failed for H=ec2-35-179-145-192.eu-west-2.compute.amazonaws.com (172.26.4.214) [35.179.145.192]:55802: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:53:09 host2 sshd[711339]: Disconnected from invalid user avigilon 66.154.117.138 port 60912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:52:49 host2 sshd[710956]: Disconnected from invalid user influxdb 161.248.201.228 port 36572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:53:28 host2 sshd[711546]: Disconnected from invalid user super 103.183.74.205 port 34300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:54:12 host2 sshd[712115]: Disconnected from invalid user super 152.32.129.236 port 45156 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 02:53:42 host2 sshd[711722]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Jan 15 02:53:53 host2 sshd[711828]: Disconnected from invalid user mssql 62.219.172.50 port 44026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:53:56 host2 sshd[711857]: Disconnected from invalid user bind 161.248.201.228 port 49846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:04 host2 sshd[712028]: Disconnected from invalid user sysdiag 103.183.74.205 port 54916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:38 host2 sshd[712489]: Disconnected from invalid user avigilon 103.183.74.205 port 38248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-15 03:00:51 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (wookt) [98.193.112.85]:46000: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-15 03:01:36 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:48136: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-15 03:02:27 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:52033: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-15 03:02:48 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:57404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.41
country_id: 3865483
description:
Jan 15 03:06:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.64.71.41, lip=66.85.158.91, TLS, session=<lUiV5V9I2pS6QEcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-15 03:06:44 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:58581: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-15 03:06:17 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [103.26.53.164]:60898: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.218
country_id: 953987
description:
Jan 15 03:07:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=102.64.40.218, lip=66.85.158.91, TLS, session=<JxRz519IBoVmQCja>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-15 03:11:02 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (gatents) [73.197.236.163]:51494: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 03:14:36 host2 sshd[727755]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 03:14:42 host2 sshd[727808]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 03:16:35 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:60640: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-15 03:16:17 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:34424: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-15 03:16:34 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:42112: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-15 03:17:00 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:34620: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2026-01-15 03:17:14 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:50426: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-15 03:17:43 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:49150: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-15 03:21:29 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:36558: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-15 03:21:11 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45112: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.35.100
country_id: 1831722
description:
Jan 15 03:22:18 host2 pure-ftpd[734568]: (?@160.202.35.100) [INFO] New connection from 160.202.35.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-15 03:23:42 dovecot_plain authenticator failed for H=(anklet) [102.53.15.180]:44174: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.61
country_id: 3469034
description:
Jan 15 03:24:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.39.142.61, lip=66.85.158.91, TLS, session=<q/mYJ2BIPtOxJ449>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.249
country_id: 953987
description:
Jan 15 03:25:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=102.64.42.249, lip=66.85.158.91, TLS, session=<mBThKGBIbYdmQCr5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 03:31:00 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (solical) [81.226.88.121]:50626: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.172
country_id: 3057568
description:
Jan 15 03:32:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=91.226.113.172, lip=66.85.158.91, TLS, session=<GOAUQmBIvbVb4nGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.43
country_id: 953987
description:
Jan 15 03:32:00 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.46.43, lip=66.85.158.91, TLS, session=<5Z/VQGBIZstmQC4r>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 03:33:22 host2 sshd[741728]: Disconnected from invalid user user 2.57.121.25 port 54361 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-15 03:34:07 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (tingued) [98.196.209.55]:59278: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Jan 15 03:35:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zw4STmBIPM/N0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 03:35:53 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:46423: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-15 03:36:18 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:44942: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-15 03:36:43 dovecot_login authenticator failed for H=([127.0.0.1]) [182.64.3.94]:43306: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.42
country_id: 1269750
description:
2026-01-15 03:36:57 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.62.42]:48892: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-15 03:37:34 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:35574: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-15 03:38:02 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:39606: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 6251999
description:
Jan 15 03:38:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.91, TLS: Connection closed, session=<72PhWGBIioJV2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-15 03:40:24 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:53738: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-15 03:40:43 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:54470: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:41:17 host2 sshd[748101]: Disconnected from invalid user ubuntu 34.93.128.179 port 55074 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.94
country_id: 6252001
description:
Jan 15 03:41:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.233.112.94, lip=66.85.158.92, session=<9p4mY2BIRJeH6XBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 03:42:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:60014: 535 Incorrect authentication data (set_id=office2)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:37 host2 pure-ftpd[749396]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Jan 15 03:43:08 host2 sshd[749254]: Disconnected from invalid user ubuntu 103.100.208.88 port 51649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:44:26 host2 sshd[750221]: Disconnected from invalid user ubuntu 181.237.114.175 port 45220 [preauth]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:50 host2 pure-ftpd[749547]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 03:45:45 host2 sshd[751493]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.7
country_id: 6252001
description:
Jan 15 03:45:01 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.184.7, lip=66.85.158.91, session=<DH96cGBI5rMofLgH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:16 host2 sshd[751093]: Disconnected from invalid user admin 181.237.114.175 port 58656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:45:19 host2 sshd[751132]: Disconnected from invalid user ubuntu 34.93.128.179 port 54130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:56 host2 sshd[751642]: Disconnected from invalid user ubuntu 181.237.114.175 port 42242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Jan 15 03:47:13 host2 sshd[753384]: Disconnected from invalid user ubuntu 103.186.1.120 port 51102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:47:50 host2 sshd[754060]: Disconnected from invalid user ubuntu 34.93.128.179 port 39684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:50:25 host2 sshd[756637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Jan 15 03:51:08 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.91, session=<Rl9ghmBIAFqs7OQm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:51:49 host2 sshd[757690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 03:55:33 host2 sshd[761596]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-15 03:56:04 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:48290: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.4
country_id: 6251999
description:
Jan 15 03:57:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.4, lip=66.85.158.91, session=<XGcgnGBIfJJV2ZUE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan 15 03:59:20 host2 sshd[764680]: Disconnected from invalid user puppet 38.47.94.55 port 35504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-15 04:01:52 dovecot_login authenticator failed for H=([50.187.152.61]) [50.187.152.61]:58526: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:03:12 host2 sshd[767932]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-15 04:02:17 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:60582: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 04:04:08 host2 sshd[768542]: Disconnected from invalid user user 2.57.121.25 port 12774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.218
country_id: 6252001
description:
Jan 15 04:04:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.124.218, lip=66.85.158.92, session=<UhMOt2BIUOgNWXza>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Jan 15 04:05:42 host2 pure-ftpd[769972]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 04:06:00 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:60173: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Jan 15 04:08:26 host2 sshd[771856]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 65334


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-15 04:09:16 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42508: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-15 04:09:36 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:39562: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-15 04:11:09 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:50099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-15 04:11:37 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55636: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 04:23:56 host2 sshd[785381]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:25:09 host2 sshd[786559]: Disconnected from invalid user guest 45.78.230.104 port 44030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:25:34 host2 sshd[786939]: Disconnected from invalid user splunk 138.197.123.123 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2026-01-15 04:25:47 dovecot_login authenticator failed for H=(nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:59376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:26:27 host2 sshd[787892]: Disconnected from invalid user luis 34.92.81.41 port 41150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:27:32 host2 sshd[788877]: Disconnected from invalid user honeywell 34.92.81.41 port 58728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:28:45 host2 sshd[789963]: Disconnected from invalid user pvserver 34.92.81.41 port 56454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Jan 15 04:28:37 host2 sshd[789886]: Disconnected from invalid user nagios 206.81.27.245 port 55254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:30:06 host2 sshd[791316]: Disconnected from invalid user admin 45.78.230.104 port 36284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:30:14 host2 sshd[791576]: Disconnected from invalid user activemq 138.197.123.123 port 35314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:31:06 host2 sshd[792279]: Disconnected from invalid user Admin 45.78.230.104 port 57260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:30:29 host2 sshd[791822]: Disconnected from invalid user upload 72.17.34.38 port 54630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:30:34 host2 sshd[791881]: Disconnected from invalid user hudson 172.191.157.64 port 46390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:31:18 host2 sshd[792504]: Disconnected from invalid user ansible 138.197.123.123 port 44258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:31:42 host2 sshd[792949]: Disconnected from invalid user alertmanager 103.91.246.101 port 35530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:32:09 host2 sshd[793409]: Disconnected from invalid user extreme 72.17.34.38 port 59880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-15 04:32:46 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:59985: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:52 host2 sshd[794192]: Disconnected from invalid user dba 103.91.246.101 port 55280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:18 host2 sshd[793523]: Disconnected from invalid user kafka 103.91.246.101 port 36610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:33:55 host2 sshd[795087]: Disconnected from invalid user nagios 172.191.157.64 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:33:16 host2 sshd[794593]: Disconnected from invalid user avaya 45.78.230.104 port 42492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-15 04:33:27 dovecot_login authenticator failed for H=([122.186.230.25]) [125.19.161.150]:42606: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Jan 15 04:34:35 host2 sshd[795586]: Disconnected from invalid user www-data 172.208.48.177 port 33538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 04:34:15 dovecot_plain authenticator failed for H=(augent) [12.150.243.22]:8913: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:35:29 host2 sshd[796810]: Disconnected from invalid user amcrest 172.191.157.64 port 37604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-15 04:36:49 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:54010: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-15 04:37:07 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:44478: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 04:37:58 host2 sshd[799281]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-15 04:38:51 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:53070: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.138.29
country_id: 2921044
description:
Jan 15 04:39:34 host2 sshd[800960]: Disconnected from invalid user manager 164.92.138.29 port 13096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-15 04:40:13 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:34186: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 04:39:15 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:51425: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-15 04:39:35 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:47624: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-15 04:41:01 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:47652: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-15 04:43:18 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:54696: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.27
country_id: 6252001
description:
Jan 15 04:47:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.27, lip=66.85.158.91, session=<CK2dTmFIlI0NWX0b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-15 04:47:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:54914: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-15 04:47:17 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:40710: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:49:28 host2 sshd[810557]: Disconnected from invalid user dbsnmp 200.90.8.86 port 58870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:50:10 host2 sshd[811486]: Disconnected from invalid user testuser 200.90.8.86 port 38276 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:50:38 host2 sshd[811948]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:51:30 host2 sshd[812505]: Disconnected from invalid user aladmin 200.90.8.86 port 52074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-15 04:51:32 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59786: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-15 04:52:08 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:58254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 04:52:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.185.111
country_id: 357994
description:
2026-01-15 04:52:12 dovecot_plain authenticator failed for H=(minkless) [154.177.185.111]:41036: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-15 04:52:49 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:46979: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-15 04:53:09 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:43957: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-15 04:53:11 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (wrestious) [73.144.27.228]:46816: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 04:57:36 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:48753: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 04:57:56 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:53535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.46
country_id: 1210997
description:
2026-01-15 04:58:40 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.46]:52404: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 05:00:30 host2 sshd[821362]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 05:00:36 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:51990: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.13.8.139
country_id: 1269750
description:
Jan 15 05:10:58 host2 sshd[831227]: Disconnected from invalid user work 135.13.8.139 port 43788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-15 05:15:14 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:58367: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 05:14:39 host2 sshd[833849]: Disconnected from invalid user user 2.57.121.25 port 26137 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-01-15 05:15:52 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:50448: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.17
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.131.17, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DCrauGFIVLItnIMR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:52 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<HbjxuGFIbcYtnIMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.19
country_id: 2264397
description:
Jan 15 05:16:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZjUDuWFIJ4UtnIMT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.18
country_id: 2264397
description:
Jan 15 05:16:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.18, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<dHNHuWFI64EtnIMS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<qPbRuGFIB+ktnIMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.218
country_id: 953987
description:
2026-01-15 05:22:45 dovecot_login authenticator failed for H=([196.25.113.220]) [196.25.113.218]:59945: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan 15 05:25:09 host2 sshd[841818]: Disconnected from invalid user maint 187.170.3.81 port 58348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan 15 05:24:53 host2 sshd[841508]: Disconnected from invalid user couchbase 103.172.154.255 port 58018 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.117.58.67
country_id: 614540
description:
Jan 15 05:27:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=85.117.58.67, lip=66.85.158.91, TLS, session=<c7qM32FI3pJVdTpD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.55
country_id: 2510769
description:
Jan 15 05:28:24 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=185.143.92.55, lip=66.85.158.91, TLS, session=<8Vw+4WFIFo25j1w3>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 05:29:59 host2 sshd[845228]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Jan 15 05:29:41 host2 sshd[845053]: Disconnected from invalid user mongo 187.170.3.81 port 60112 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.10.31.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.10.31.88 - topviewl "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-15 05:31:52 dovecot_login authenticator failed for H=([122.184.143.81]) [182.95.47.2]:59002: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-15 05:32:34 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:44067: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 05:32:57 host2 sshd[847504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 05:34:21 host2 sshd[848401]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 05:35:55 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:61575: 535 Incorrect authentication data (set_id=bx)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 05:37:13 host2 sshd[850456]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-15 05:38:40 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:58492: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-15 05:38:59 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:36480: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.233
country_id: 6252001
description:
Jan 15 05:44:32 host2 pure-ftpd[855812]: (?@40.124.175.233) [INFO] New connection from 40.124.175.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-15 05:45:10 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:45574: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 05:44:42 host2 sshd[855939]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2026-01-15 05:45:45 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:56019: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.56
country_id: 6252001
description:
Jan 15 05:48:17 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.56, lip=66.85.158.92, TLS, session=<T/1OKWJIuurG6xg4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 15 05:48:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<zluOKWJInICLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-15 05:51:12 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (troctorted) [174.166.153.20]:51612: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - neotechl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user neotechl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 05:54:14 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 05:55:24 host2 sshd[865754]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2026-01-15 06:01:09 dovecot_login authenticator failed for H=([46.30.161.197]) [46.30.161.197]:43528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-15 06:01:28 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:43350: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-15 06:06:01 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:44006: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2026-01-15 06:06:18 dovecot_login authenticator failed for H=77-173-41-213.cust.keyyo.net [213.41.173.77]:33317: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 06:11:07 host2 sshd[877928]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:12:06 host2 sshd[878684]: Disconnected from invalid user installer 185.196.10.62 port 54296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.138
country_id: 1269750
description:
2026-01-15 06:12:59 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.183.138]:53734: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.9
country_id: 1733045
description:
2026-01-15 06:13:12 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.9]:42828: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:16:32 host2 sshd[881686]: Disconnected from invalid user sendmail 185.196.10.62 port 57118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:16:58 host2 sshd[881967]: Disconnected from invalid user radius 152.32.252.65 port 50320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:17:40 host2 sshd[882450]: Disconnected from invalid user redhat 152.32.252.65 port 59680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Jan 15 06:18:21 host2 sshd[883061]: Disconnected from invalid user dell 152.32.252.65 port 49738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.62
country_id: 2635167
description:
Jan 15 06:21:03 host2 sshd[885251]: Disconnected from invalid user admin 185.196.10.62 port 51010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-15 06:22:26 dovecot_plain authenticator failed for H=(droyely) [65.20.133.4]:38644: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-15 06:24:23 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:44193: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2026-01-15 06:24:26 dovecot_login authenticator failed for H=([128.185.254.54]) [128.185.254.54]:42774: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 06:24:36 host2 sshd[887747]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-15 06:24:46 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:33552: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 06:24:54 host2 sshd[887924]: Disconnected from invalid user user 2.57.121.25 port 10473 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 06:29:53 host2 sshd[891666]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-15 06:31:03 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:37740: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-15 06:30:38 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:39112: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 06:33:22 host2 sshd[894781]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:37:59 host2 sshd[898564]: Disconnected from invalid user sambauser 164.90.225.61 port 36194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-15 06:39:09 dovecot_plain authenticator failed for H=(misna) [65.20.164.137]:41148: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 06:38:29 host2 sshd[898919]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:39:42 host2 sshd[899705]: Disconnected from invalid user admin 164.90.225.61 port 48174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Jan 15 06:40:12 host2 sshd[900187]: Disconnected from invalid user dynamics 164.90.225.61 port 57526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 06:48:44 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:54083: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 06:49:16 host2 sshd[907051]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-01-15 06:49:18 dovecot_login authenticator failed for H=([127.0.0.1]) [181.56.174.63]:60860: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.94.19
country_id: 1861060
description:
2026-01-15 06:49:26 dovecot_login authenticator failed for H=19.94.156.220.rev.iijmobile.jp ([127.0.0.1]) [220.156.94.19]:36530: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-15 06:51:06 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (tince) [67.173.58.47]:58662: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2026-01-15 06:54:51 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:50711: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-15 06:55:16 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:46618: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-15 06:55:20 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:60458: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2026-01-15 06:55:29 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61693: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan 15 06:55:42 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.251.174, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x85yGmNImqCYIPuu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.90
country_id: 1819730
description:
Jan 15 06:55:59 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.142.154.90, lip=66.85.158.91, TLS, session=<AatnG2NIPBUtjppa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 06:56:01 dovecot_plain authenticator failed for H=(ovant) [12.150.243.22]:63515: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.101.251
country_id: 3144096
description:
2026-01-15 06:56:10 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.101.251]:56574: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-01-15 06:56:23 dovecot_login authenticator failed for H=([127.0.0.1]) [98.122.215.23]:39480: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-15 06:58:09 dovecot_plain authenticator failed for H=(flulthed) [5.32.99.14]:38433: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.175.185.90
country_id: 690791
description:
Jan 15 07:00:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=46.175.185.90, lip=66.85.158.91, TLS, session=<t2IDKWNIY4our7la>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.147
country_id: 798544
description:
Jan 15 07:00:21 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=193.192.179.147, lip=66.85.158.91, TLS, session=<l+AVKmNIBcvBwLOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-15 07:01:30 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:44113: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-15 07:01:19 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:42076: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 07:01:24 host2 sshd[916720]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-15 07:02:07 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36785: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.252.64.174
country_id: 3469034
description:
Jan 15 07:02:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=38.252.64.174, lip=66.85.158.91, TLS, session=<7K1TMGNIVr4m/ECu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-15 07:02:17 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (falivendly) [24.15.216.41]:58814: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.104
country_id: 3469034
description:
Jan 15 07:02:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=168.0.224.104, lip=66.85.158.91, TLS, session=<1Dp9MWNIZdmoAOBo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 07:03:45 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (proge) [87.103.126.54]:37950: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 07:04:27 host2 sshd[918965]: Disconnected from invalid user user 2.57.121.25 port 23646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-15 07:06:02 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:40270: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 18.192.58.4
country_id: 2921044
description:
2026-01-15 07:06:45 dovecot_login authenticator failed for H=ec2-18-192-58-4.eu-central-1.compute.amazonaws.com (172.26.13.22) [18.192.58.4]:51701: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-15 07:06:50 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (nistry) [98.40.101.10]:44824: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.109.76
country_id: 3144096
description:
2026-01-15 07:08:01 dovecot_login authenticator failed for H=([127.0.0.1]) [84.214.109.76]:44180: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.185.190
country_id: 1269750
description:
2026-01-15 07:08:10 dovecot_login authenticator failed for H=([127.0.0.1]) [122.185.185.190]:38350: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:09:43 host2 sshd[922825]: Disconnected from invalid user kubernetes 103.86.180.10 port 46850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:10:26 host2 sshd[923451]: Disconnected from invalid user acti 152.32.129.140 port 56906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:12:22 host2 sshd[925012]: Disconnected from invalid user artifactory 103.86.180.10 port 37294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 15 07:11:42 host2 sshd[924438]: Disconnected from invalid user apps 103.86.180.10 port 59848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:13:08 host2 sshd[925567]: Disconnected from invalid user test 152.32.129.140 port 43952 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 07:14:10 host2 sshd[926306]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Jan 15 07:13:46 host2 sshd[925981]: Disconnected from invalid user enable 152.32.129.140 port 55382 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 07:13:49 host2 sshd[926062]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-15 07:15:26 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (nuffato) [76.145.10.140]:54260: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:14:39 host2 sshd[926679]: Disconnected from invalid user kerberos 36.89.28.139 port 36000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:16:56 host2 sshd[928494]: Disconnected from invalid user salt 36.89.28.139 port 35694 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 07:17:28 host2 sshd[928959]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Jan 15 07:17:45 host2 sshd[929111]: Disconnected from invalid user sendmail 36.89.28.139 port 60420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.250.54
country_id: 3469034
description:
Jan 15 07:19:35 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.11.250.54, lip=66.85.158.91, TLS, session=<vrqgbmNIRe2xC/o2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.175
country_id: 732800
description:
Jan 15 07:19:36 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=185.255.215.175, lip=66.85.158.91, TLS, session=<Si3cbmNIDJe5/9ev>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.92
country_id: 798544
description:
Jan 15 07:19:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=109.125.248.92, lip=66.85.158.91, TLS, session=<6M32b2NIMRJtffhc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Jan 15 07:19:56 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<UxsMcGNIFdhBFI59>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-15 07:23:45 dovecot_plain authenticator failed for H=(plaste) [65.20.205.197]:56236: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-15 07:23:48 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (iscrous) [73.183.74.177]:45972: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 73.190.196.228
country_id: 6252001
description:
Jan 15 07:28:29 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=73.190.196.228, lip=66.85.158.91, TLS, session=<HtuLj2NIjuRJvsTk>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:23 host2 sshd[936715]: Disconnecting authenticating user root 98.191.229.175 port 51608: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:31 host2 sshd[936780]: Disconnecting invalid user admin 98.191.229.175 port 53526: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.58
country_id: 1269750
description:
2026-01-15 07:27:41 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.237.58]:53256: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.3
country_id: 1733045
description:
2026-01-15 07:27:55 dovecot_login authenticator failed for H=([127.0.0.1]) [49.124.152.3]:39474: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Jan 15 07:28:23 host2 sshd[936715]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 51608 ssh2 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 07:31:02 host2 sshd[938628]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-15 07:32:01 dovecot_login authenticator failed for H=([152.52.234.33]) [182.95.174.18]:57768: 535 Incorrect authentication data (set_id=signinhr)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 185.177.72.70
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 185.177.72.70: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2026-01-15 07:31:49 dovecot_login authenticator failed for H=([103.186.193.149]) [103.186.193.149]:43452: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 07:33:13 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:65142: 535 Incorrect authentication data (set_id=lina@dipendajatim.go.id)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Jan 15 07:33:44 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.4, lip=66.85.158.91, TLS, session=<bLtqomNI4trCpGsE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-15 07:37:46 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:56892: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-15 07:38:17 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:51329: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 07:39:29 host2 sshd[944730]: Disconnected from invalid user user 2.57.121.25 port 13133 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-15 07:40:08 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50164: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-01-15 07:40:47 dovecot_login authenticator failed for H=([49.124.155.189]) [49.124.155.189]:41414: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 07:42:08 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:54008: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-15 07:45:04 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:22773: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Jan 15 07:45:22 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mh0JzGNIedbN0h/c>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan 15 07:46:34 host2 sshd[950052]: User essenceceylontea from 122.175.193.205 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 165.232.179.250
country_id: 1269750
description:
Jan 15 07:51:56 host2 sshd[954248]: User essenceceylontea from 165.232.179.250 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 07:57:48 host2 sshd[959416]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 08:01:09 host2 sshd[962098]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-15 08:02:46 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:58164: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 08:03:16 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:35501: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2026-01-15 08:03:30 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:42612: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:03:49 host2 sshd[964016]: Disconnected from invalid user ubuntu 117.102.17.18 port 33724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:03:10 host2 sshd[963542]: Disconnected from invalid user admin 117.102.17.18 port 46284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:04:23 host2 sshd[964402]: Disconnected from invalid user admin 117.102.17.18 port 34198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.102.17.18
country_id: 1168579
description:
Jan 15 08:04:58 host2 sshd[964732]: Disconnected from invalid user admin 117.102.17.18 port 50584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-15 08:07:36 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:54540: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 08:06:58 host2 sshd[966334]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-01-15 08:07:29 dovecot_login authenticator failed for H=([71.12.241.225]) [71.12.241.225]:40086: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:09:34 host2 sshd[968267]: Disconnected from invalid user admin 67.222.132.207 port 59032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:10:25 host2 sshd[968986]: Disconnected from invalid user ubuntu 45.93.168.44 port 39024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:11:31 host2 sshd[969801]: Disconnected from invalid user ubuntu 67.222.132.207 port 59226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-15 08:11:42 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (conthely) [73.168.136.150]:39946: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:11:47 host2 sshd[970141]: Disconnected from invalid user ubuntu 45.93.168.44 port 36446 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 08:12:20 host2 sshd[970679]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:12:03 host2 sshd[970427]: Disconnected from invalid user admin 67.222.132.207 port 59294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Jan 15 08:12:14 host2 sshd[970557]: Disconnected from invalid user ubuntu 45.93.168.44 port 41212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-15 08:12:44 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:43862: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.222.132.207
country_id: 6252001
description:
Jan 15 08:13:07 host2 sshd[971409]: Disconnected from invalid user ubuntu 67.222.132.207 port 59430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-15 08:13:41 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:47919: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 08:16:26 dovecot_plain authenticator failed for H=(antler) [12.150.243.22]:44603: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-15 08:17:11 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45426: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-15 08:17:16 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (adried) [217.215.74.195]:37324: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-15 08:17:27 dovecot_login authenticator failed for H=(nsg-corporate-66.230.187.122.airtel.in) [122.187.230.66]:51858: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2026-01-15 08:18:06 dovecot_login authenticator failed for H=bl23-65-30.dsl.telepac.pt [144.64.65.30]:2689: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2026-01-15 08:18:44 dovecot_login authenticator failed for H=([49.124.159.179]) [49.124.159.179]:33186: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-15 08:19:07 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:36332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2026-01-15 08:19:19 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:53834: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-15 08:19:46 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:36796: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.18.69
country_id: 6252001
description:
2026-01-15 08:22:21 dovecot_login authenticator failed for H=(209-141-18-69.sfn.uct-usa.com) [209.141.18.69]:54577: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 08:22:27 host2 sshd[978392]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


