# incident

plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 16:10:09 host2 sshd[176943]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.60.88.192
country_id: 3175395
description:
Jan 14 16:11:26 host2 sshd[178367]: Disconnected from invalid user ubuntu 151.60.88.192 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan 14 16:11:11 host2 sshd[178116]: Disconnected from invalid user admin 41.80.35.45 port 42980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.164
country_id: 241170
description:
Jan 14 16:12:31 host2 sshd[179387]: Disconnected from invalid user admin 212.11.64.164 port 42298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.164
country_id: 241170
description:
Jan 14 16:13:00 host2 sshd[179791]: Disconnected from invalid user ubuntu 212.11.64.164 port 49212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-14 16:13:59 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:44947: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-14 16:13:47 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:53086: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:16:19 host2 sshd[182391]: Disconnected from invalid user apache 13.73.111.251 port 47566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:16:37 host2 sshd[182564]: Disconnected from invalid user centos 154.72.233.36 port 64974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:17:38 host2 sshd[183291]: Disconnected from invalid user clickhouse 154.72.233.36 port 61640 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.14
country_id: 1210997
description:
[2026-01-14 16:17:11 +0530] info [cpaneld] 103.55.146.14 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.16.178
country_id: 1819730
description:
Jan 14 16:17:30 host2 sshd[183189]: Disconnected from invalid user ubuntu 154.221.16.178 port 47917 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:18:39 host2 sshd[183927]: Disconnected from invalid user def 154.72.233.36 port 45956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan 14 16:19:12 host2 sshd[184289]: Disconnected from invalid user ctxsys 154.72.233.36 port 42724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Jan 14 16:19:51 host2 sshd[184900]: Disconnected from invalid user cron 195.158.4.216 port 62625 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.89.127
country_id: 6252001
description:
Jan 14 16:20:59 host2 sshd[185890]: Disconnected from invalid user apache 172.190.89.127 port 43976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Jan 14 16:21:36 host2 sshd[186335]: Disconnected from invalid user storage 195.158.4.216 port 40933 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan 14 16:21:43 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<hmOe5FZIOpTE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:22:11 host2 sshd[186795]: Disconnected from invalid user clickhouse 13.73.111.251 port 52292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.73.111.251
country_id: 2077456
description:
Jan 14 16:22:48 host2 sshd[187195]: Disconnected from invalid user debian 13.73.111.251 port 60676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.82.181.183
country_id: 6252001
description:
2026-01-14 16:24:10 dovecot_login authenticator failed for H=ool-4352b5b7.dyn.optonline.net [67.82.181.183]:33712: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-14 16:24:28 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:58214: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-14 16:25:41 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:43593: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:26:23 host2 sshd[189885]: Disconnected from invalid user admin 103.154.77.48 port 38288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-14 16:26:32 dovecot_login authenticator failed for H=([125.22.73.41]) [122.186.201.62]:51136: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-14 16:26:50 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:27:44 host2 sshd[190952]: Disconnected from invalid user ubuntu 103.154.77.48 port 59876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan 14 16:28:18 host2 sshd[191366]: Disconnected from invalid user admin 103.154.77.48 port 42194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2026-01-14 16:32:25 dovecot_login authenticator failed for H=([182.78.144.34]) [182.78.144.34]:54404: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-14 16:32:46 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:58778: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:37:47 host2 sshd[199333]: Disconnected from invalid user ubuntu 52.237.80.79 port 60400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:37:33 host2 sshd[199055]: Disconnected from invalid user admin 43.133.146.37 port 57698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 16:37:42 host2 dovecot[149701]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<u1HNHVdIq7p100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:39:24 host2 sshd[200640]: Disconnected from invalid user admin 52.237.80.79 port 42984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:39:49 host2 sshd[200903]: Disconnected from invalid user admin 43.133.146.37 port 43614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 14 16:40:47 host2 sshd[201731]: Disconnected from invalid user admin 45.126.84.154 port 57612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:41:04 host2 sshd[201968]: Disconnected from invalid user ubuntu 52.237.80.79 port 49550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.146.37
country_id: 1643084
description:
Jan 14 16:40:22 host2 sshd[201484]: Disconnected from invalid user ubuntu 43.133.146.37 port 59730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Jan 14 16:40:28 host2 sshd[201538]: Disconnected from invalid user ubuntu 52.237.80.79 port 41050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 14 16:42:30 host2 sshd[203060]: Disconnected from invalid user ubuntu 45.126.84.154 port 34112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.150.194.114
country_id: 6252001
description:
Jan 14 16:46:08 host2 dovecot[149701]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.150.194.114, lip=66.85.158.91, TLS, session=<b4sjPFdIXsgUlsJy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-01-14 16:48:06 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:45151: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-14 16:48:19 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:41598: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-14 16:56:54 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4991: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-14 16:57:12 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:41214: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-14 17:03:45 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (destubs) [98.227.25.115]:49248: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 14 17:03:51 host2 sshd[221617]: Disconnected from invalid user admin 2.57.121.112 port 46146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-14 17:12:55 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:50608: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-14 17:17:22 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:34783: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-14 17:17:51 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:34117: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2026-01-14 17:18:22 dovecot_login authenticator failed for H=([179.185.18.67]) [179.185.18.67]:36763: 535 Incorrect authentication data (set_id=hostmaster@comdef.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.234
country_id: 6252001
description:
Jan 14 17:20:55 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.234, lip=66.85.158.92, TLS, session=</JWIuFdIwIIofK3q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.15.118.76
country_id: 2464461
description:
2026-01-14 17:23:30 dovecot_login authenticator failed for H=([127.0.0.1]) [197.15.118.76]:51791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.249.50.9
country_id: 1269750
description:
2026-01-14 17:23:38 dovecot_login authenticator failed for H=([127.0.0.1]) [117.249.50.9]:57561: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:30:04 host2 sshd[244781]: Disconnected from invalid user frappe 201.48.78.29 port 49742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:32:32 host2 sshd[246670]: Disconnected from invalid user neo4j 91.147.92.31 port 56118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:32:43 host2 sshd[246797]: Disconnected from invalid user oracle 201.48.78.29 port 58376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan 14 17:33:27 host2 sshd[247374]: Disconnected from invalid user freepbx 201.48.78.29 port 42610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.150.41.194
country_id: 3996063
description:
Jan 14 17:33:29 host2 sshd[247401]: Disconnected from invalid user git 201.150.41.194 port 58872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.150.41.194
country_id: 3996063
description:
Jan 14 17:35:51 host2 sshd[249415]: Disconnected from invalid user procurve 201.150.41.194 port 59338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.20.208
country_id: 2264397
description:
2026-01-14 17:36:10 dovecot_plain authenticator failed for H=([26.49.122.131]) [149.88.20.208]:52162: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.20.208
country_id: 2264397
description:
2026-01-14 17:36:17 dovecot_login authenticator failed for H=([26.49.122.131]) [149.88.20.208]:52162: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:36:20 host2 sshd[250084]: Disconnected from invalid user karaf 91.147.92.31 port 35742 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.20
country_id: 597427
description:
Jan 14 17:37:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.132.194.20, lip=66.85.158.91, TLS, session=<6rWO81dIZOYthMIU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.17
country_id: 3439705
description:
Jan 14 17:37:26 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.17, lip=66.85.158.91, session=<12Gf81dIvNwtVGYR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.159
country_id: 1835841
description:
Jan 14 17:37:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.244.42.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<u8Sj81dIQOOt9Cqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.9
country_id: 2328926
description:
Jan 14 17:37:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PVCO81dIXOaSRkEJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.147.92.31
country_id: 1522867
description:
Jan 14 17:37:35 host2 sshd[250994]: Disconnected from invalid user anonymous 91.147.92.31 port 43040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-14 17:39:11 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:58674: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-14 17:42:05 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (matineured) [73.183.74.177]:60674: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2026-01-14 17:41:37 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:38110: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-14 17:41:50 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:60751: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:43:25 host2 sshd[255885]: Disconnected from invalid user geovision 201.249.192.30 port 52801 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.117.223
country_id: 6252001
description:
Jan 14 17:44:07 host2 pure-ftpd[256473]: (?@172.202.117.223) [INFO] New connection from 172.202.117.223


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.111.208
country_id: 3175395
description:
Jan 14 17:45:46 host2 sshd[258136]: Disconnected from invalid user su 151.43.111.208 port 35034 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:45:55 host2 sshd[258289]: Disconnected from invalid user db2admin 201.249.192.30 port 47918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-14 17:47:14 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:41277: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan 14 17:46:33 host2 sshd[258875]: Disconnected from invalid user vpsuser 201.249.192.30 port 28337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-14 17:46:44 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:59886: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.218.9.86
country_id: 3469034
description:
Jan 14 17:46:50 host2 sshd[259387]: Disconnected from invalid user couchbase 181.218.9.86 port 46598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.218.9.86
country_id: 3469034
description:
Jan 14 17:47:34 host2 sshd[259945]: Disconnected from invalid user httpadmin 181.218.9.86 port 49126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.241
country_id: 2921044
description:
Jan 14 17:48:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.179.241, lip=66.85.158.92, session=<tj9ZG1hIxVGnrLPx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.143.76
country_id: 2921044
description:
Jan 14 17:48:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.143.76, lip=66.85.158.92, session=<IiJhG1hIyMRo+I9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:48:41 host2 sshd[260862]: Disconnected from invalid user cyber 103.210.21.242 port 51696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.192.94.162
country_id: 1643084
description:
Jan 14 17:48:42 host2 sshd[260876]: Disconnected from invalid user mqtt 139.192.94.162 port 43198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:49:20 host2 sshd[261321]: Disconnected from invalid user su 103.210.21.242 port 50734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.242
country_id: 1880251
description:
Jan 14 17:49:55 host2 sshd[261752]: Disconnected from invalid user elasticsearch 103.210.21.242 port 51204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Jan 14 17:51:10 host2 sshd[263169]: Disconnected from invalid user User 190.129.122.12 port 1351 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.42.239.222
country_id: 102358
description:
Jan 14 17:51:16 host2 sshd[263244]: Disconnected from invalid user mariadb 5.42.239.222 port 60424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Jan 14 17:50:27 host2 sshd[262479]: Disconnected from invalid user sa 66.96.239.187 port 54604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:51:21 host2 sshd[263317]: Disconnected from invalid user influxdb 102.88.137.213 port 17402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan 14 17:51:40 host2 sshd[263603]: Disconnected from invalid user wildfly 82.24.64.220 port 55810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 17:51:48 host2 sshd[263672]: Disconnected from invalid user user 2.57.121.25 port 39980 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 17:52:45 host2 sshd[264564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Jan 14 17:52:24 host2 sshd[264180]: Disconnected from invalid user acti 118.26.36.241 port 33818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.220
country_id: 2635167
description:
Jan 14 17:52:41 host2 sshd[264522]: Disconnected from invalid user bal 82.24.64.220 port 50156 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 17:54:14 host2 sshd[265975]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.42.239.222
country_id: 102358
description:
Jan 14 17:53:37 host2 sshd[265303]: Disconnected from invalid user kubernetes 5.42.239.222 port 49708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.192.94.162
country_id: 1643084
description:
Jan 14 17:53:57 host2 sshd[265567]: Disconnected from invalid user influxdb 139.192.94.162 port 43388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.37.194.181
country_id: 2264397
description:
Jan 14 17:53:47 host2 sshd[265414]: Disconnected from invalid user ubuntu 188.37.194.181 port 58990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:53:49 host2 sshd[265449]: Disconnected from invalid user azure 102.88.137.213 port 17176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.161.12
country_id: 6252001
description:
Jan 14 17:53:34 host2 sshd[265284]: Disconnected from invalid user ubnt 143.198.161.12 port 47922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.37.194.181
country_id: 2264397
description:
Jan 14 17:54:18 host2 sshd[266098]: Disconnected from invalid user redisadmin 188.37.194.181 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan 14 17:54:30 host2 sshd[266515]: Disconnected from invalid user liberty 102.88.137.213 port 1429 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-14 17:54:35 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:20528: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.80.134.10
country_id: 6252001
description:
Jan 14 17:55:13 host2 sshd[267504]: Disconnected from invalid user celery 129.80.134.10 port 58256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.216.252
country_id: 2921044
description:
Jan 14 17:55:58 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.90.216.252, lip=66.85.158.92, TLS, session=<32HdNVhIqk+kWtj8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.111.208
country_id: 3175395
description:
Jan 14 18:00:28 host2 sshd[271762]: Disconnected from invalid user upload 151.43.111.208 port 35670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-14 18:02:47 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:60964: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-14 18:03:02 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:48188: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-14 18:04:23 dovecot_login authenticator failed for H=([122.169.40.221]) [103.26.53.164]:41344: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2026-01-14 18:04:45 dovecot_login authenticator failed for H=([125.17.183.33]) [182.95.184.142]:38612: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.75.254.157
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 51.75.254.157 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-14 18:24:45 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:45236: 535 Incorrect authentication data (set_id=business@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2026-01-14 18:24:51 dovecot_login authenticator failed for H=(17.54.gonzagatelecom.com.br) [177.128.54.17]:34228: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-14 18:24:57 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:37070: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-14 18:25:08 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:51252: 535 Incorrect authentication data (set_id=business)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 18:25:37 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:35874: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-14 18:26:06 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (couts) [73.195.211.98]:60594: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 18:27:15 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XlKkpVhIPOR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.137.167
country_id: 1733045
description:
2026-01-14 18:28:16 dovecot_login authenticator failed for H=([127.0.0.1]) [121.121.137.167]:19191: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-14 18:28:32 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:55360: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.233.231.160
country_id: 2750405
description:
2026-01-14 18:28:38 dovecot_login authenticator failed for H=customer-213-233-231-160.solcon.nl ([127.0.0.1]) [213.233.231.160]:39688: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-14 18:28:43 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:43712: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-14 18:31:52 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:57149: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.249.234.70
country_id: 3469034
description:
2026-01-14 18:32:42 dovecot_plain authenticator failed for H=(DFM-APP-02.dfm.local) [186.249.234.70]:50535: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-14 18:33:23 dovecot_login authenticator failed for H=([182.95.229.38]) [182.95.229.38]:52092: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.249.234.70
country_id: 3469034
description:
Jan 14 18:33:30 host2 sshd[302909]: Invalid user info@idesignvector.com from 186.249.234.70 port 64462


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-14 18:33:37 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:50186: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-01-14 18:35:52 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:64039: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-14 18:36:11 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:39002: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.86
country_id: 6252001
description:
Jan 14 18:36:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.105.86, lip=66.85.158.92, session=<n6eixlhIKuYUUGlW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-14 18:37:23 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:57721: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.144.90
country_id: 6252001
description:
Jan 14 18:39:28 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.144.90, lip=66.85.158.91, session=<H4110VhI8IcUQZBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.205.23
country_id: 3595528
description:
Jan 14 18:45:06 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.239.205.23, lip=66.85.158.91, TLS, session=<QiKS5VhIGqCt780X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.22.68
country_id: 2510769
description:
Jan 14 18:45:05 host2 dovecot[221878]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.70.22.68, lip=66.85.158.91, session=<iuaP5VhIBsKSRhZE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.159
country_id: 1835841
description:
Jan 14 18:45:06 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.42.159, lip=66.85.158.91, session=<FM+T5VhIAsKt9Cqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.176.86.40
country_id: 2921044
description:
Jan 14 18:45:06 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=193.176.86.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+2aS5VhIGKDBsFYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:01:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ZgSxHllISpIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:02:03 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<tFIwIllIwN0DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 19:01:25 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:56376: 535 Incorrect authentication data (set_id=meeting@gaido.co.id)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.245.186
country_id: 1605651
description:
Jan 14 19:03:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.245.186, lip=66.85.158.91, session=<3TWjJllIzrSYIPW6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.245.186
country_id: 1605651
description:
Jan 14 19:03:19 host2 dovecot[221878]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.245.186, lip=66.85.158.91, session=<YwfDJllICraYIPW6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:03:26 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<5iwqJ1lIzM4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:04:23 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<d+iRKllIYpADhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-14 19:04:56 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:61896: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2026-01-14 19:05:27 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:47760: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-01-14 19:05:37 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (bionones) [68.38.201.238]:55438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 19:05:46 host2 sshd[329302]: Disconnected from invalid user user 2.57.121.25 port 5196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:05:49 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<iZGuL1lI7qIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:07:04 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MxUpNFlICIsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:06:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<t0sKMllIBugDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:07:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0eahNVlInOUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:08:05 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<zh7CN1lIBK8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:08:24 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<mxXoOFlIKtsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 14 19:09:23 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<NappPFlIPsYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.82.82
country_id: 2921044
description:
Jan 14 19:11:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.22.82.82, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DfuYRVlI9kGlFlJS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-14 19:12:36 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (precablen) [73.230.86.50]:43600: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-14 19:18:09 dovecot_plain authenticator failed for H=(janink) [154.144.243.93]:46390: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-14 19:18:23 dovecot_plain authenticator failed for H=(aulity) [65.20.129.28]:36076: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-14 19:20:20 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:51398: 535 Incorrect authentication data (set_id=postmaster@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2026-01-14 19:20:55 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:42598: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-14 19:21:12 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:41562: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-14 19:23:04 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:49968: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-14 19:22:34 dovecot_login authenticator failed for H=([125.19.70.49]) [182.95.58.62]:55252: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-14 19:22:38 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:58042: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-14 19:23:36 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:58968: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-14 19:35:50 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:64246: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2026-01-14 19:35:15 dovecot_login authenticator failed for H=(104.214.46.200.psinetpa.net) [200.46.214.110]:34138: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-14 19:35:32 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:58496: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-14 19:35:35 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:55472: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:36:40 host2 sshd[353818]: Disconnected from invalid user admin 197.39.111.219 port 41896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:37:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Zov8oVlIKtkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:38:43 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<2EZcpVlIcrsDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:39:23 host2 sshd[356031]: Disconnected from invalid user ubuntu 196.221.196.5 port 33170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:39:45 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<OPYLqVlItLIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-14 19:39:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (dicid) [87.103.126.54]:19666: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:40:15 host2 sshd[356954]: Disconnected from invalid user ubuntu 196.219.224.230 port 33096 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 19:41:48 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<x+VesFlIxroDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-01-14 19:42:26 dovecot_login authenticator failed for H=([127.0.0.1]) [188.126.241.118]:37060: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.38.217.83
country_id: 2077456
description:
2026-01-14 19:42:15 dovecot_login authenticator failed for H=([127.0.0.1]) [161.38.217.83]:46428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:42:20 host2 sshd[358913]: Disconnected from invalid user admin 196.219.224.230 port 33550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:44:21 host2 sshd[360616]: Disconnected from invalid user ubuntu 197.39.111.219 port 37820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-14 19:44:28 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:58997: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.219.224.230
country_id: 357994
description:
Jan 14 19:45:40 host2 sshd[361939]: Disconnected from invalid user ubuntu 196.219.224.230 port 57906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:46:21 host2 sshd[362539]: Disconnected from invalid user admin 196.221.196.5 port 55238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.196.5
country_id: 357994
description:
Jan 14 19:48:17 host2 sshd[364448]: Disconnected from invalid user ubuntu 196.221.196.5 port 55800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.39.111.219
country_id: 357994
description:
Jan 14 19:49:32 host2 sshd[365541]: Disconnected from invalid user ubuntu 197.39.111.219 port 48666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2026-01-14 19:51:42 dovecot_login authenticator failed for H=([149.54.62.66]) [149.54.62.66]:56891: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 14 19:57:23 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=36.64.30.151, lip=66.85.158.91, TLS, session=<kYSk5llIRtEkQB6X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-14 19:56:30 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:49173: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-14 19:56:29 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:59346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2026-01-14 19:56:45 dovecot_login authenticator failed for H=([84.213.189.27]) [84.213.189.27]:45688: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan 14 19:57:41 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<ex4F6VlITJPE+2YS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.57.184.151
country_id: 1269750
description:
Jan 14 19:57:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=103.57.184.151, lip=66.85.158.91, TLS, session=<QXou6FlI/JBnObiX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-14 20:05:11 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:37962: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-14 20:05:18 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:43427: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-14 20:04:38 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:34770: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 20:11:53 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Y/6qG1pIRaV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-14 20:17:08 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:53372: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-14 20:17:34 dovecot_login authenticator failed for H=([90.161.217.228]) [90.161.217.228]:45397: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2026-01-14 20:17:46 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:46150: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Jan 14 20:21:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=68.183.3.153, lip=66.85.158.92, session=<0VLtP1pIOoBEtwOZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan 14 20:22:36 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<Om0AQlpIuNzE+2YP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-14 20:22:39 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:63616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-14 20:23:16 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:47952: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-14 20:24:25 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:50388: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-01-14 20:24:49 dovecot_login authenticator failed for H=([122.187.181.57]) [182.95.174.178]:41418: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-14 20:28:01 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (urnal) [73.188.252.208]:49120: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:34:20 host2 sshd[403779]: Disconnected from invalid user ubuntu 86.54.42.125 port 48488 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:34:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 29 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<lMtPbVpIC9ojy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:35:45 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 30 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gNxOcVpImPEjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:35:55 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<BFTtcVpIcs0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:36:27 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<U4PKc1pImuUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:36:40 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<D/2SdFpI8uojy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:37:25 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<s5M9d1pICqsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:38:42 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0hXae1pIgsgDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:40:02 host2 sshd[408058]: Disconnected from invalid user admin 86.54.42.125 port 48924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:39:29 host2 sshd[407754]: Disconnected from invalid user ubuntu 86.54.42.125 port 60212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-14 20:39:31 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:42965: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:39:41 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<h0tYf1pIkKUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:41:11 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<UGbEhFpIro0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-14 20:40:32 dovecot_login authenticator failed for H=(nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:49936: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:42:06 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<j9cFiFpIkp4DjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.55
country_id: 6252001
description:
Jan 14 20:41:33 host2 pure-ftpd[409631]: (?@147.185.132.55) [INFO] New connection from 147.185.132.55


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.125
country_id: 241170
description:
Jan 14 20:41:35 host2 sshd[409638]: Disconnected from invalid user admin 86.54.42.125 port 55644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Jan 14 20:42:04 host2 sshd[410034]: Disconnected from invalid user ubuntu 151.243.213.125 port 42330 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:42:04 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Ihrqh1pIiJ4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<0hBwi1pIoqQDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:06 host2 dovecot[221878]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<5diXi1pIsKQDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.243.213.125
country_id: 290557
description:
Jan 14 20:43:13 host2 sshd[410815]: Disconnected from invalid user ubuntu 151.243.213.125 port 39854 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:43:46 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<NYn1jVpIINYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Jan 14 20:44:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.214, lip=66.85.158.92, TLS, session=<KxI7kFpIcuQjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 14 20:44:45 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=</Ct/kVpIGqUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-14 20:45:21 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:39226: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-14 20:46:10 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:44938: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.54
country_id: 6252001
description:
Jan 14 20:49:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<tBKYo1pIFMwUQGk2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 14 20:51:36 host2 sshd[417921]: Disconnected from invalid user user 2.57.121.25 port 32078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.202.225.79
country_id: 6252001
description:
2026-01-14 20:54:07 dovecot_login authenticator failed for H=wsip-72-202-225-79.lv.lv.cox.net [72.202.225.79]:49089: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-14 20:55:38 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (kints) [73.144.27.228]:42106: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.224
country_id: 2186224
description:
2026-01-14 20:55:58 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.224]:56810: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.122.10
country_id: 3144096
description:
2026-01-14 20:56:05 dovecot_login authenticator failed for H=([127.0.0.1]) [46.212.122.10]:54429: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Jan 14 20:56:16 host2 pure-ftpd[422352]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 20:56:57 host2 sshd[422791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 20:58:24 host2 sshd[423775]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.109.81.222
country_id: 1605651
description:
2026-01-14 20:59:06 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [101.109.81.222]:60675: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Jan 14 20:59:25 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, TLS: Connection closed, session=<d2T5xVpIZurLN4MF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-14 20:59:54 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:48752: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:01:49 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PaaKzlpIzcwjy9IZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.131.199
country_id: 1269750
description:
Jan 14 21:03:31 host2 sshd[428070]: Disconnected from invalid user will 64.227.131.199 port 33532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-14 21:03:31 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:45140: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:02:46 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GnXt0VpIqOcjy9IZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:03:38 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<ZPgA1VpIpvQjy9IZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-14 21:04:15 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:37808: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Jan 14 21:04:45 host2 sshd[429058]: Disconnected from invalid user lighttpd 64.227.131.199 port 40012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.25
country_id: 2635167
description:
Jan 14 21:09:39 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.25, lip=66.85.158.91, TLS, session=<w/mK6lpInvojy9IZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 21:13:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Y4Rr91pIA7R100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Jan 14 21:22:02 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.38, lip=66.85.158.92, TLS: Connection closed, session=<JBnTFltILP5BMQEm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.136.54.7
country_id: 614540
description:
Jan 14 21:22:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.136.54.7, lip=66.85.158.91, TLS, session=<lSgSF1tIjoYtiDYH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.47
country_id: 6252001
description:
Jan 14 21:21:50 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.47, lip=66.85.158.92, session=<PM8ZFltIKaBBMQEv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.185
country_id: 3469034
description:
Jan 14 21:22:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=190.89.136.185, lip=66.85.158.91, TLS, session=<Ki1WGFtIUqm+WYi5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-14 21:24:17 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (incentiols) [73.183.74.177]:60594: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.202
country_id: 3175395
description:
Jan 14 21:27:44 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=171.22.233.202, lip=66.85.158.91, TLS, session=<7qU2KltIx8yrFunK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.250.216.79
country_id: 953987
description:
Jan 14 21:28:11 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=196.250.216.79, lip=66.85.158.91, TLS, session=<6taAK1tIZOPE+thP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.48.26
country_id: 6252001
description:
Jan 14 21:28:44 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.48.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ifHKLltI+OEUajAa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-14 21:32:03 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:54748: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-14 21:32:24 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:45790: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:33:25 host2 sshd[452478]: Disconnected from invalid user nagiosadmin 172.96.179.9 port 54320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:33:52 host2 sshd[452948]: Disconnected from invalid user default 172.96.179.9 port 34534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:35:17 host2 sshd[454476]: Disconnected from invalid user webserver 172.96.179.9 port 54216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.22
country_id: 953987
description:
Jan 14 21:36:12 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.47.22, lip=66.85.158.91, TLS, session=<4p8/SFtI9ORmQC8W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.123
country_id: 690791
description:
Jan 14 21:36:31 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=176.103.5.123, lip=66.85.158.91, TLS, session=<pbuZSVtIQsGwZwV7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan 14 21:35:46 host2 sshd[454885]: Disconnected from invalid user dell 172.96.179.9 port 40388 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:20 host2 pure-ftpd[459271]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:55 host2 pure-ftpd[459958]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 142.248.80.119
country_id: 6252001
description:
Jan 14 21:40:55 host2 pure-ftpd[459955]: (?@142.248.80.119) [INFO] New connection from 142.248.80.119


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Jan 14 21:48:46 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VDxxdltIItlAPpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-14 21:50:02 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:58584: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-14 21:50:41 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:55450: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-14 21:51:06 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:48158: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.74: 250 connections per 30 seconds to 2078 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.74: 415 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-14 22:05:05 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:36901: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 22:07:55 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Grq6ultI29d100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-14 22:09:50 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:47492: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-14 22:09:28 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:41492: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-14 22:14:13 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:55164: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-14 22:15:06 dovecot_login authenticator failed for H=(nsg-corporate-153.189.187.122.airtel.in) [125.19.220.30]:35652: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-01-14 22:14:32 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:56518: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2026-01-14 22:14:51 dovecot_login authenticator failed for H=([196.28.226.66]) [196.28.226.66]:56178: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.54
country_id: 2186224
description:
2026-01-14 22:16:54 dovecot_login authenticator failed for H=([121.73.162.54]) [121.73.162.54]:40598: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2026-01-14 22:16:41 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:42906: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-14 22:21:16 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:39426: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-14 22:21:39 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38835: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-14 22:22:00 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:13266: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan 14 22:23:56 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<FeMH9FtI1rrE+2YR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-14 22:26:03 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:33846: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.243
country_id: 1819730
description:
2026-01-14 22:26:19 dovecot_login authenticator failed for H=243.142.48.116.static.netvigator.com [116.48.142.243]:53177: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-14 22:25:49 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:41069: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-14 22:26:00 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:56528: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.146.208.102
country_id: 6252001
description:
Jan 14 22:28:16 host2 pure-ftpd[512245]: (?@54.146.208.102) [INFO] New connection from 54.146.208.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2026-01-14 22:29:48 dovecot_login authenticator failed for H=([103.165.174.234]) [103.165.174.234]:41682: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-14 22:30:06 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (hivey) [68.40.189.43]:46138: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-14 22:30:10 dovecot_plain authenticator failed for H=(wavullecte) [80.227.147.94]:51885: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-14 22:29:28 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:59668: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-14 22:33:18 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:58140: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-01-14 22:33:30 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:53020: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan 14 22:34:10 host2 pure-ftpd[516622]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-14 22:34:13 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:48147: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-14 22:35:14 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:54754: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-14 22:35:38 dovecot_login authenticator failed for H=([182.95.119.118]) [182.95.119.118]:34864: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-14 22:37:20 dovecot_login authenticator failed for H=([182.95.7.193]) [182.95.59.154]:59422: 535 Incorrect authentication data (set_id=reception@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.232.183.203
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 165.232.183.203 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-14 22:38:10 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:46564: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2026-01-14 22:38:17 dovecot_login authenticator failed for H=([196.190.43.139]) [196.190.41.137]:36910: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-14 22:38:33 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2026-01-14 22:39:11 dovecot_plain authenticator failed for H=(patiblea) [212.225.255.82]:51147: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 22:41:17 host2 sshd[522450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 14 22:42:43 host2 sshd[523405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 22:42:47 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<vMFwN1xIa4t100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-14 22:44:41 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:52710: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2026-01-14 22:44:57 dovecot_login authenticator failed for H=(cm-178.232.147.85.get.no) [178.232.147.85]:58039: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.247
country_id: 1733045
description:
2026-01-14 22:54:09 dovecot_login authenticator failed for H=([49.124.150.247]) [49.124.150.247]:52550: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.8
country_id: 6252001
description:
Jan 14 23:01:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.33.109.8, lip=66.85.158.91, session=<YEGLe1xIao0tIW0I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2026-01-14 23:03:22 dovecot_plain authenticator failed for H=(cathoded) [5.32.22.218]:45542: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-14 23:03:28 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:37299: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.144
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.144: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan 14 23:04:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, session=<AXBFhlxIcGK4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan 14 23:05:15 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, session=<J9z0h1xINhm4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2026-01-14 23:05:26 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:60523: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.148
country_id: 1733045
description:
2026-01-14 23:08:50 dovecot_login authenticator failed for H=([49.124.152.148]) [49.124.152.148]:44922: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-14 23:09:08 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:63627: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.74.190.239
country_id: 3469034
description:
Jan 14 23:10:47 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.74.190.239, lip=66.85.158.91, TLS, session=<z6SfmlxIqNSxSr7v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.78
country_id: 3469034
description:
Jan 14 23:11:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=190.89.137.78, lip=66.85.158.91, TLS, session=<WTXfm1xIlo2+WYlO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-14 23:16:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:58336: 535 Incorrect authentication data (set_id=cacti)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 23:17:33 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kzrSs1xIbNV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-14 23:19:18 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:60509: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.235.182.125
country_id: 298795
description:
2026-01-14 23:19:36 dovecot_login authenticator failed for H=([127.0.0.1]) [176.235.182.125]:57294: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.237.134
country_id: 1269750
description:
2026-01-14 23:19:52 dovecot_login authenticator failed for H=([127.0.0.1]) [125.23.237.134]:59754: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-14 23:19:57 dovecot_login authenticator failed for H=([128.185.119.9]) [125.19.188.98]:34816: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-14 23:23:19 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:49886: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-14 23:23:48 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:46256: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Jan 14 23:24:26 host2 sshd[559016]: Disconnected from invalid user download 198.98.56.227 port 39964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.252.157.42
country_id: 298795
description:
Jan 14 23:24:38 host2 sshd[559167]: Disconnected from invalid user sybase 89.252.157.42 port 33334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-14 23:24:43 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:37058: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-14 23:24:57 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:14498: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Jan 14 23:27:09 host2 sshd[561140]: Disconnected from invalid user sys 198.98.56.227 port 47452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.48
country_id: 3017382
description:
Jan 14 23:28:34 host2 sshd[562241]: Disconnected from invalid user ubuntu 51.83.71.48 port 45186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Jan 14 23:28:42 host2 sshd[562301]: Disconnected from invalid user dell 198.98.56.227 port 40928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 14 23:28:43 host2 sshd[562325]: Disconnected from invalid user ubuntu 128.1.38.64 port 51734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Jan 14 23:29:30 host2 sshd[563019]: Disconnected from invalid user admin 190.0.63.226 port 60846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.65.186
country_id: 2017370
description:
Jan 14 23:29:32 host2 sshd[563034]: Disconnected from invalid user ldap 45.89.65.186 port 46480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.252.157.42
country_id: 298795
description:
Jan 14 23:30:21 host2 sshd[563786]: Disconnected from invalid user websphere 89.252.157.42 port 55382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Jan 14 23:30:05 host2 sshd[563555]: Disconnected from invalid user ubuntu 190.0.63.226 port 43916 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.252.157.42
country_id: 298795
description:
Jan 14 23:31:28 host2 sshd[564521]: Disconnected from invalid user ldap 89.252.157.42 port 55970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.65.186
country_id: 2017370
description:
Jan 14 23:32:29 host2 sshd[565197]: Disconnected from invalid user procurve 45.89.65.186 port 57304 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.48
country_id: 3017382
description:
Jan 14 23:34:27 host2 sshd[566824]: Disconnected from invalid user ubuntu 51.83.71.48 port 45820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.101.12
country_id: 1269750
description:
Jan 14 23:38:07 host2 sshd[569664]: Disconnected from invalid user admin 157.245.101.12 port 46150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-14 23:40:48 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:39322: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.132
country_id: 1269750
description:
2026-01-14 23:40:23 dovecot_login authenticator failed for H=(nsg-corporate-132.229.187.122.airtel.in) [122.187.229.132]:34392: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.224.169
country_id: 2921044
description:
Jan 14 23:40:24 host2 pure-ftpd[571772]: (?@164.92.224.169) [INFO] New connection from 164.92.224.169


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-14 23:43:08 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:39660: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-14 23:43:20 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:43304: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-14 23:44:53 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:60974: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-14 23:45:19 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:54004: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-14 23:45:33 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (tions) [2.135.31.74]:39985: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 14 23:48:06 host2 sshd[578052]: Disconnected from invalid user admin 128.1.38.64 port 52752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-14 23:52:42 dovecot_plain authenticator failed for H=(gerish) [75.97.190.237]:59848: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 14 23:52:48 host2 sshd[581683]: Disconnected from invalid user ubuntu 128.1.38.64 port 57960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 14 23:53:03 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<8Y7IMl1I765100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-14 23:54:57 dovecot_login authenticator failed for H=([84.214.49.11]) [84.214.49.11]:54909: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-14 23:55:09 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:58068: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.149
country_id: 6252001
description:
Jan 14 23:58:52 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.149, lip=66.85.158.92, TLS handshaking: Connection closed, session=<y2q2R11IxV9APpyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan 14 23:59:10 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<roDFSF1IdlpAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.200
country_id: 3469034
description:
Jan 15 00:01:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.179.189.200, lip=66.85.158.91, TLS, session=<NdDVT11IU6Ats73I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.76
country_id: 3469034
description:
Jan 15 00:01:58 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=177.44.71.76, lip=66.85.158.91, TLS, session=<suCzUV1Iw8mxLEdM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.127.222.185
country_id: 3057568
description:
2026-01-15 00:02:10 dovecot_login authenticator failed for H=adsl-dyn185.91-127-222.t-com.sk ([127.0.0.1]) [91.127.222.185]:38393: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2026-01-15 00:02:17 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:35584: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.39
country_id: 1269750
description:
2026-01-15 00:02:22 dovecot_login authenticator failed for H=([127.0.0.1]) [117.248.201.39]:58686: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.154.204.178
country_id: 2921044
description:
Jan 15 00:01:45 host2 pure-ftpd[589505]: (?@207.154.204.178) [INFO] New connection from 207.154.204.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-15 00:02:49 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:36148: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.126.222.110
country_id: 6252001
description:
2026-01-15 00:03:01 dovecot_login authenticator failed for H=174-126-222-110.cpe.sparklight.net [174.126.222.110]:51352: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.72
country_id: 1643084
description:
Jan 15 00:03:23 host2 sshd[590704]: Disconnected from invalid user mosquitto 103.31.39.72 port 59174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-15 00:02:34 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:38246: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.177.179.12
country_id: 1668284
description:
2026-01-15 00:03:50 dovecot_login authenticator failed for H=(4prMKpzPm) [213.177.179.12]:50892: 535 Incorrect authentication data (set_id=info@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan 15 00:08:28 host2 sshd[594657]: Disconnected from invalid user sage 109.241.24.186 port 36780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.72
country_id: 1643084
description:
Jan 15 00:10:01 host2 sshd[595783]: Disconnected from invalid user naztec 103.31.39.72 port 46788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.241.24.186
country_id: 798544
description:
Jan 15 00:11:30 host2 sshd[597216]: Disconnected from invalid user newuser 109.241.24.186 port 36428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.72
country_id: 1643084
description:
Jan 15 00:11:51 host2 sshd[597484]: Disconnected from invalid user oleg 103.31.39.72 port 38954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.1.4
country_id: 6252001
description:
Jan 15 00:18:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=18.144.1.4, lip=66.85.158.92, TLS: Connection closed, session=<kteqjF1IBNYSkAEE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-15 00:22:29 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:49738: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-15 00:22:52 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:50448: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 00:24:43 host2 sshd[607909]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-15 00:24:43 dovecot_login authenticator failed for H=(nsg-corporate-41.139.185.122.airtel.in) [182.95.184.130]:35774: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-15 00:25:14 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:37514: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 00:26:07 host2 sshd[609281]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.6
country_id: 3469034
description:
Jan 15 00:26:14 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=191.53.130.6, lip=66.85.158.91, TLS, session=<zjaKqF1IYKW/NYIG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.145
country_id: 3175395
description:
Jan 15 00:26:32 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=185.15.169.145, lip=66.85.158.91, TLS, session=<lbWsqV1Iu8C5D6mR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-15 00:26:59 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (comprosite) [71.224.169.28]:41164: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.16
country_id: 6252001
description:
Jan 15 00:29:22 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<y47DtF1IateTuYQQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 00:29:04 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kxCZs11IPph100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.188.199.189
country_id: 6252001
description:
Jan 15 00:30:59 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.188.199.189, lip=66.85.158.91, TLS: Connection closed, session=<gkyUul1Ivto2vMe9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-15 00:31:02 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (cotoph) [73.137.7.97]:47582: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-15 00:33:11 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (supectic) [73.88.196.91]:37220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.166
country_id: 1269750
description:
2026-01-15 00:34:04 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.166]:44136: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.78
country_id: 1269750
description:
2026-01-15 00:34:23 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.182.78]:34064: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-01-15 00:40:12 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:49852: 535 Incorrect authentication data (set_id=postmaster@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2026-01-15 00:40:29 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:39868: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.69.89.141
country_id: 2635167
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 5.69.89.141 - topviewl "GET /execute/DomainInfo/list_domains HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2026-01-15 00:45:31 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:49161: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2026-01-15 00:45:56 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:45724: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.3.51
country_id: 2750405
description:
Jan 15 00:49:23 host2 sshd[627857]: Disconnected from invalid user devuser 138.124.3.51 port 48074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-15 00:49:49 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:53297: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Jan 15 00:50:03 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.91, session=<JfDD/l1ISuOTuYQt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-15 00:49:32 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:57321: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Jan 15 00:50:57 host2 sshd[629497]: Disconnected from invalid user sage 189.178.26.161 port 42996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.24
country_id: 1643084
description:
Jan 15 00:52:08 host2 sshd[630364]: Disconnected from invalid user weblogic 103.176.79.24 port 58194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan 15 00:52:02 host2 sshd[630331]: Disconnected from invalid user test 189.178.26.161 port 37772 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.217.173.50
country_id: 1527747
description:
Jan 15 00:52:34 host2 sshd[630695]: Disconnected from invalid user postfix 178.217.173.50 port 35858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.42
country_id: 1643084
description:
Jan 15 00:53:10 host2 sshd[631233]: Disconnected from invalid user apc 103.193.178.42 port 47472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.42
country_id: 1643084
description:
Jan 15 00:55:11 host2 sshd[633524]: Disconnected from invalid user sonar 103.193.178.42 port 41866 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.85.72
country_id: 6252001
description:
Jan 15 00:54:48 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.85.72, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GL/AD15I+sgUqVVI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 00:55:42 dovecot_plain authenticator failed for H=(rachi) [12.150.243.22]:4221: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.12.21.138
country_id: 6252001
description:
2026-01-15 00:55:45 dovecot_plain authenticator failed for H=104-12-21-138.lightspeed.chrlnc.sbcglobal.net (haropne) [104.12.21.138]:33376: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.24
country_id: 1643084
description:
Jan 15 00:57:10 host2 sshd[635088]: Disconnected from invalid user server 103.176.79.24 port 53702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-15 00:57:42 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:45892: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2026-01-15 00:57:51 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:39140: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.88.197
country_id: 6252001
description:
Jan 15 01:00:57 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.80.88.197, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Mke9JV5IVpkUUFjF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Jan 15 01:02:09 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2YkJKl5IiptBMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.56
country_id: 6252001
description:
Jan 15 01:02:20 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.56, lip=66.85.158.91, session=<eSmxKl5IMRZAPsU4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Jan 15 01:02:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6bUaK15I5FJBMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Jan 15 01:02:32 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS: Connection closed, session=<nfNmK15IeDtAPsUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 01:03:23 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hebraved) [87.103.126.54]:40309: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan 15 01:05:27 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<SBG1NV5IKofE+2YL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.66.173
country_id: 3144096
description:
2026-01-15 01:06:33 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.66.173]:55443: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.53.226
country_id: 614540
description:
2026-01-15 01:06:44 dovecot_login authenticator failed for H=([127.0.0.1]) [213.131.53.226]:34248: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-15 01:07:18 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:44376: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-15 01:07:33 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:29155: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 01:10:16 host2 sshd[642825]: Disconnected from invalid user user 2.57.121.25 port 14032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2026-01-15 01:13:37 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:46301: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-15 01:14:12 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:44196: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.235.150.44
country_id: 1269750
description:
2026-01-15 01:15:21 dovecot_login authenticator failed for H=srv1.brainbean.in [13.235.150.44]:37862: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-15 01:15:27 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:45782: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.235.150.44
country_id: 1269750
description:
2026-01-15 01:15:30 dovecot_login authenticator failed for H=srv1.brainbean.in [13.235.150.44]:38076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2026-01-15 01:15:32 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:58135: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-15 01:15:50 dovecot_login authenticator failed for H=([122.187.76.169]) [182.95.124.202]:39696: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 01:20:31 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (press) [81.226.88.121]:55025: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-15 01:21:11 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:49596: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-01-15 01:28:53 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:33908: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-15 01:32:03 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:34682: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-15 01:32:26 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:39598: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 01:33:20 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<vMtomV5Imbx100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-15 01:36:30 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:38044: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2026-01-15 01:36:46 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:64050: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2026-01-15 01:38:47 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:33891: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 01:40:09 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:56923: 535 Incorrect authentication data (set_id=cyrus)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-01-15 01:39:30 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:43690: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.188
country_id: 1269750
description:
Jan 15 01:43:07 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.104.127.188, lip=66.85.158.91, TLS, session=<XZ94u15IaI5naH+8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.250.133
country_id: 2395170
description:
Jan 15 01:43:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=41.223.250.133, lip=66.85.158.91, TLS, session=<Uz+ovF5ITqQp3/qF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-15 01:47:00 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:46033: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-15 01:46:46 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:51216: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Jan 15 01:52:02 host2 sshd[665325]: Disconnected from invalid user loader 160.251.172.221 port 47282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-15 01:56:07 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:59190: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-15 01:55:50 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:48701: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Jan 15 01:57:37 host2 sshd[670160]: Disconnected from invalid user admin 34.91.0.68 port 47296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Jan 15 02:00:13 host2 sshd[672354]: Disconnected from invalid user ubuntu 34.91.0.68 port 55608 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.91.0.68
country_id: 2750405
description:
Jan 15 02:02:10 host2 sshd[673597]: Received disconnect from 34.91.0.68 port 50960:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan 15 02:02:14 host2 sshd[673636]: Disconnected from invalid user docker 189.50.142.82 port 34455 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Jan 15 02:01:52 host2 sshd[673408]: Disconnected from invalid user ubuntu 85.18.236.229 port 42766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan 15 02:03:41 host2 sshd[674607]: Disconnected from invalid user app 189.50.142.82 port 38361 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Jan 15 02:05:19 host2 sshd[675984]: Disconnected from invalid user gcp 189.50.142.82 port 43800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.196
country_id: 3865483
description:
Jan 15 02:05:27 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=179.0.249.196, lip=66.85.158.91, TLS, session=<XQ5GC19Ih6OzAPnE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan 15 02:04:53 host2 sshd[675380]: Disconnected from invalid user admin 103.187.165.26 port 43280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.162
country_id: 3865483
description:
Jan 15 02:05:50 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=179.0.251.162, lip=66.85.158.91, TLS, session=<a1mGDF9I4ruzAPui>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.84.20
country_id: 1643084
description:
Jan 15 02:06:50 host2 sshd[677005]: Disconnected from invalid user ubuntu 103.171.84.20 port 54234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan 15 02:06:41 host2 sshd[676852]: Disconnected from invalid user rsyncuser 189.50.142.82 port 42371 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 02:07:41 host2 sshd[677631]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 15 02:08:22 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uXSyFl9IF99100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-15 02:07:40 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:46859: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.61.42.69
country_id: 2300660
description:
Jan 15 02:08:17 host2 sshd[678170]: Disconnected from invalid user zabbix 196.61.42.69 port 40936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.84.20
country_id: 1643084
description:
Jan 15 02:07:34 host2 sshd[677533]: Disconnected from invalid user ubuntu 103.171.84.20 port 49440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.187.167.234
country_id: 6252001
description:
2026-01-15 02:07:53 dovecot_login authenticator failed for H=wsip-98-187-167-234.fv.ks.cox.net [98.187.167.234]:47690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 02:09:04 host2 sshd[678810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Jan 15 02:08:33 host2 sshd[678391]: Disconnected from invalid user bot 41.223.40.77 port 55106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Jan 15 02:08:45 host2 sshd[678528]: Disconnected from invalid user sonarqube 167.71.128.40 port 34754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Jan 15 02:09:08 host2 sshd[678828]: Disconnected from invalid user alcatel 41.223.40.77 port 57506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan 15 02:09:33 host2 sshd[679174]: Disconnected from invalid user ubuntu 103.187.165.26 port 36546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.225
country_id: 1269750
description:
Jan 15 02:09:44 host2 sshd[679272]: Disconnected from invalid user ubuntu 130.250.191.225 port 48584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-15 02:11:06 dovecot_plain authenticator failed for H=(unatilo) [64.72.74.162]:39426: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan 15 02:11:14 host2 sshd[680646]: Disconnected from invalid user bot 103.153.190.105 port 38982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.225
country_id: 1269750
description:
Jan 15 02:10:33 host2 sshd[680024]: Disconnected from invalid user admin 130.250.191.225 port 35424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Jan 15 02:11:48 host2 sshd[680974]: Disconnected from invalid user rancher 167.71.128.40 port 39700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.128.40
country_id: 2635167
description:
Jan 15 02:12:15 host2 sshd[681289]: Disconnected from invalid user weblogic 167.71.128.40 port 56322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan 15 02:12:28 host2 sshd[681391]: Disconnected from invalid user winccd 103.153.190.105 port 45494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.61.42.69
country_id: 2300660
description:
Jan 15 02:12:53 host2 sshd[681649]: Disconnected from invalid user dhcp 196.61.42.69 port 57956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.61.42.69
country_id: 2300660
description:
Jan 15 02:13:29 host2 sshd[682214]: Disconnected from invalid user rstudio 196.61.42.69 port 33586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 15 02:13:54 host2 sshd[682513]: Disconnected from invalid user splunkadmin 52.172.177.191 port 45460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 15 02:14:29 host2 sshd[682849]: Disconnected from invalid user bot 52.172.177.191 port 53912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-15 02:17:20 dovecot_plain authenticator failed for H=(annylants) [92.62.243.174]:44903: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.188.0.71
country_id: 3996063
description:
Jan 15 02:18:47 host2 sshd[685877]: Disconnected from invalid user watchguard 187.188.0.71 port 35262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-15 02:19:26 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:19349: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan 15 02:26:34 host2 sshd[692257]: Disconnected from invalid user sonar 117.247.111.70 port 13607 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Jan 15 02:27:13 host2 sshd[692758]: Disconnected from invalid user splunk 117.247.111.70 port 20061 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2026-01-15 02:27:46 dovecot_login authenticator failed for H=(ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:42501: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan 15 02:27:55 host2 sshd[693301]: Disconnected from invalid user apc 117.247.111.70 port 39573 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2026-01-15 02:27:59 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:58616: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.48.124.84
country_id: 2661886
description:
Jan 15 02:29:32 host2 sshd[694397]: Disconnected from invalid user vpnuser 13.48.124.84 port 54018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.136.86
country_id: 1819730
description:
Jan 15 02:30:02 host2 sshd[694741]: Disconnected from invalid user mosquitto 103.117.136.86 port 42514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.48.124.84
country_id: 2661886
description:
Jan 15 02:30:39 host2 sshd[695473]: Disconnected from invalid user icinga 13.48.124.84 port 59956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.136.86
country_id: 1819730
description:
Jan 15 02:31:59 host2 sshd[696359]: Disconnected from invalid user elasticsearch 103.117.136.86 port 42766 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 02:37:45 host2 sshd[700235]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:46:32 host2 sshd[706443]: Disconnected from invalid user bind 66.154.117.138 port 47290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:48:20 host2 sshd[707604]: Disconnected from invalid user mssql 45.61.149.143 port 48836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:49:30 host2 sshd[708307]: Disconnected from invalid user artifactory 45.61.149.143 port 49280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:48:55 host2 sshd[707922]: Disconnected from invalid user sa 152.32.129.236 port 44144 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 02:49:35 host2 sshd[708374]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.149.143
country_id: 6252001
description:
Jan 15 02:50:08 host2 sshd[708858]: Disconnected from invalid user elastic 45.61.149.143 port 56482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:51:12 host2 sshd[709749]: Disconnected from invalid user alertmanager 103.183.74.205 port 58372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:51:27 host2 sshd[709983]: Disconnected from invalid user gitea 161.248.201.228 port 49468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:15 host2 sshd[710562]: Disconnected from invalid user prometheus 66.154.117.138 port 48078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:52:37 host2 sshd[710794]: Disconnected from invalid user hikvision 152.32.129.236 port 58364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:52:42 host2 sshd[710862]: Disconnected from invalid user super 66.154.117.138 port 34128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.179.145.192
country_id: 2635167
description:
2026-01-15 02:52:52 dovecot_login authenticator failed for H=ec2-35-179-145-192.eu-west-2.compute.amazonaws.com (172.26.4.214) [35.179.145.192]:55802: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.117.138
country_id: 6252001
description:
Jan 15 02:53:09 host2 sshd[711339]: Disconnected from invalid user avigilon 66.154.117.138 port 60912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:52:49 host2 sshd[710956]: Disconnected from invalid user influxdb 161.248.201.228 port 36572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:53:28 host2 sshd[711546]: Disconnected from invalid user super 103.183.74.205 port 34300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Jan 15 02:54:12 host2 sshd[712115]: Disconnected from invalid user super 152.32.129.236 port 45156 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 02:53:42 host2 sshd[711722]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Jan 15 02:53:53 host2 sshd[711828]: Disconnected from invalid user mssql 62.219.172.50 port 44026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Jan 15 02:53:56 host2 sshd[711857]: Disconnected from invalid user bind 161.248.201.228 port 49846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:04 host2 sshd[712028]: Disconnected from invalid user sysdiag 103.183.74.205 port 54916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.205
country_id: 1643084
description:
Jan 15 02:54:38 host2 sshd[712489]: Disconnected from invalid user avigilon 103.183.74.205 port 38248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-15 03:00:51 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (wookt) [98.193.112.85]:46000: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-01-15 03:01:36 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:48136: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-15 03:02:27 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:52033: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-15 03:02:48 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:57404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.41
country_id: 3865483
description:
Jan 15 03:06:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=186.64.71.41, lip=66.85.158.91, TLS, session=<lUiV5V9I2pS6QEcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-01-15 03:06:44 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:58581: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-15 03:06:17 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [103.26.53.164]:60898: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.218
country_id: 953987
description:
Jan 15 03:07:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=102.64.40.218, lip=66.85.158.91, TLS, session=<JxRz519IBoVmQCja>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-15 03:11:02 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (gatents) [73.197.236.163]:51494: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 15 03:14:36 host2 sshd[727755]: User essenceceylontea from 200.105.156.165 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 03:14:42 host2 sshd[727808]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-15 03:16:35 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:60640: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-15 03:16:17 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:34424: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-15 03:16:34 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:42112: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-15 03:17:00 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:34620: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2026-01-15 03:17:14 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:50426: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-15 03:17:43 dovecot_login authenticator failed for H=([182.95.230.142]) [182.95.230.142]:49150: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-15 03:21:29 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:36558: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-15 03:21:11 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45112: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.35.100
country_id: 1831722
description:
Jan 15 03:22:18 host2 pure-ftpd[734568]: (?@160.202.35.100) [INFO] New connection from 160.202.35.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-15 03:23:42 dovecot_plain authenticator failed for H=(anklet) [102.53.15.180]:44174: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.61
country_id: 3469034
description:
Jan 15 03:24:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.39.142.61, lip=66.85.158.91, TLS, session=<q/mYJ2BIPtOxJ449>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.249
country_id: 953987
description:
Jan 15 03:25:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=102.64.42.249, lip=66.85.158.91, TLS, session=<mBThKGBIbYdmQCr5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-15 03:31:00 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (solical) [81.226.88.121]:50626: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.172
country_id: 3057568
description:
Jan 15 03:32:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=91.226.113.172, lip=66.85.158.91, TLS, session=<GOAUQmBIvbVb4nGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.43
country_id: 953987
description:
Jan 15 03:32:00 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.46.43, lip=66.85.158.91, TLS, session=<5Z/VQGBIZstmQC4r>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 03:33:22 host2 sshd[741728]: Disconnected from invalid user user 2.57.121.25 port 54361 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-15 03:34:07 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (tingued) [98.196.209.55]:59278: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Jan 15 03:35:24 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zw4STmBIPM/N0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 03:35:53 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:46423: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-15 03:36:18 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:44942: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-15 03:36:43 dovecot_login authenticator failed for H=([127.0.0.1]) [182.64.3.94]:43306: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.42
country_id: 1269750
description:
2026-01-15 03:36:57 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.62.42]:48892: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-15 03:37:34 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:35574: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-01-15 03:38:02 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [190.104.24.6]:39606: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 6251999
description:
Jan 15 03:38:25 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.91, TLS: Connection closed, session=<72PhWGBIioJV2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-01-15 03:40:24 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:53738: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-15 03:40:43 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:54470: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:41:17 host2 sshd[748101]: Disconnected from invalid user ubuntu 34.93.128.179 port 55074 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.94
country_id: 6252001
description:
Jan 15 03:41:17 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.233.112.94, lip=66.85.158.92, session=<9p4mY2BIRJeH6XBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.220
country_id: 130758
description:
2026-01-15 03:42:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.220]:60014: 535 Incorrect authentication data (set_id=office2)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:37 host2 pure-ftpd[749396]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Jan 15 03:43:08 host2 sshd[749254]: Disconnected from invalid user ubuntu 103.100.208.88 port 51649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:44:26 host2 sshd[750221]: Disconnected from invalid user ubuntu 181.237.114.175 port 45220 [preauth]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 91.199.120.62
country_id: 2510769
description:
Jan 15 03:43:50 host2 pure-ftpd[749547]: (?@91.199.120.62) [WARNING] Authentication failed for user [anandaob]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 03:45:45 host2 sshd[751493]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.7
country_id: 6252001
description:
Jan 15 03:45:01 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.184.7, lip=66.85.158.91, session=<DH96cGBI5rMofLgH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:16 host2 sshd[751093]: Disconnected from invalid user admin 181.237.114.175 port 58656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:45:19 host2 sshd[751132]: Disconnected from invalid user ubuntu 34.93.128.179 port 54130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.237.114.175
country_id: 3686110
description:
Jan 15 03:45:56 host2 sshd[751642]: Disconnected from invalid user ubuntu 181.237.114.175 port 42242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Jan 15 03:47:13 host2 sshd[753384]: Disconnected from invalid user ubuntu 103.186.1.120 port 51102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan 15 03:47:50 host2 sshd[754060]: Disconnected from invalid user ubuntu 34.93.128.179 port 39684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:50:25 host2 sshd[756637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Jan 15 03:51:08 host2 dovecot[221878]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.91, session=<Rl9ghmBIAFqs7OQm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 15 03:51:49 host2 sshd[757690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 147.79.100.174
country_id: 3017382
description:
Jan 15 03:55:33 host2 sshd[761596]: User essenceceylontea from 147.79.100.174 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-15 03:56:04 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:48290: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.4
country_id: 6251999
description:
Jan 15 03:57:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.4, lip=66.85.158.91, session=<XGcgnGBIfJJV2ZUE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan 15 03:59:20 host2 sshd[764680]: Disconnected from invalid user puppet 38.47.94.55 port 35504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-15 04:01:52 dovecot_login authenticator failed for H=([50.187.152.61]) [50.187.152.61]:58526: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:03:12 host2 sshd[767932]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-15 04:02:17 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:60582: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 04:04:08 host2 sshd[768542]: Disconnected from invalid user user 2.57.121.25 port 12774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.124.218
country_id: 6252001
description:
Jan 15 04:04:45 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.124.218, lip=66.85.158.92, session=<UhMOt2BIUOgNWXza>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Jan 15 04:05:42 host2 pure-ftpd[769972]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 04:06:00 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:60173: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Jan 15 04:08:26 host2 sshd[771856]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 65334


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-15 04:09:16 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42508: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-15 04:09:36 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:39562: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2026-01-15 04:11:09 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:50099: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-15 04:11:37 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:55636: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 15 04:23:56 host2 sshd[785381]: User essenceceylontea from 68.178.207.8 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:25:09 host2 sshd[786559]: Disconnected from invalid user guest 45.78.230.104 port 44030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:25:34 host2 sshd[786939]: Disconnected from invalid user splunk 138.197.123.123 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2026-01-15 04:25:47 dovecot_login authenticator failed for H=(nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:59376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:26:27 host2 sshd[787892]: Disconnected from invalid user luis 34.92.81.41 port 41150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:27:32 host2 sshd[788877]: Disconnected from invalid user honeywell 34.92.81.41 port 58728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Jan 15 04:28:45 host2 sshd[789963]: Disconnected from invalid user pvserver 34.92.81.41 port 56454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Jan 15 04:28:37 host2 sshd[789886]: Disconnected from invalid user nagios 206.81.27.245 port 55254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:30:06 host2 sshd[791316]: Disconnected from invalid user admin 45.78.230.104 port 36284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:30:14 host2 sshd[791576]: Disconnected from invalid user activemq 138.197.123.123 port 35314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:31:06 host2 sshd[792279]: Disconnected from invalid user Admin 45.78.230.104 port 57260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:30:29 host2 sshd[791822]: Disconnected from invalid user upload 72.17.34.38 port 54630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:30:34 host2 sshd[791881]: Disconnected from invalid user hudson 172.191.157.64 port 46390 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Jan 15 04:31:18 host2 sshd[792504]: Disconnected from invalid user ansible 138.197.123.123 port 44258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:31:42 host2 sshd[792949]: Disconnected from invalid user alertmanager 103.91.246.101 port 35530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.17.34.38
country_id: 6252001
description:
Jan 15 04:32:09 host2 sshd[793409]: Disconnected from invalid user extreme 72.17.34.38 port 59880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-15 04:32:46 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:59985: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:52 host2 sshd[794192]: Disconnected from invalid user dba 103.91.246.101 port 55280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan 15 04:32:18 host2 sshd[793523]: Disconnected from invalid user kafka 103.91.246.101 port 36610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:33:55 host2 sshd[795087]: Disconnected from invalid user nagios 172.191.157.64 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 15 04:33:16 host2 sshd[794593]: Disconnected from invalid user avaya 45.78.230.104 port 42492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.150
country_id: 1269750
description:
2026-01-15 04:33:27 dovecot_login authenticator failed for H=([122.186.230.25]) [125.19.161.150]:42606: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Jan 15 04:34:35 host2 sshd[795586]: Disconnected from invalid user www-data 172.208.48.177 port 33538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-15 04:34:15 dovecot_plain authenticator failed for H=(augent) [12.150.243.22]:8913: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Jan 15 04:35:29 host2 sshd[796810]: Disconnected from invalid user amcrest 172.191.157.64 port 37604 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-15 04:36:49 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:54010: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2026-01-15 04:37:07 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:44478: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 15 04:37:58 host2 sshd[799281]: User essenceceylontea from 186.236.237.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-15 04:38:51 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:53070: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.138.29
country_id: 2921044
description:
Jan 15 04:39:34 host2 sshd[800960]: Disconnected from invalid user manager 164.92.138.29 port 13096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-15 04:40:13 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:34186: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-15 04:39:15 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:51425: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-15 04:39:35 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:47624: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-15 04:41:01 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:47652: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-15 04:43:18 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:54696: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.27
country_id: 6252001
description:
Jan 15 04:47:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.27, lip=66.85.158.91, session=<CK2dTmFIlI0NWX0b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-15 04:47:59 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:54914: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-15 04:47:17 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:40710: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:49:28 host2 sshd[810557]: Disconnected from invalid user dbsnmp 200.90.8.86 port 58870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:50:10 host2 sshd[811486]: Disconnected from invalid user testuser 200.90.8.86 port 38276 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 15 04:50:38 host2 sshd[811948]: User essenceceylontea from 64.23.164.189 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.90.8.86
country_id: 3625428
description:
Jan 15 04:51:30 host2 sshd[812505]: Disconnected from invalid user aladmin 200.90.8.86 port 52074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-15 04:51:32 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59786: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-15 04:52:08 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:58254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-15 04:52:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:49332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.185.111
country_id: 357994
description:
2026-01-15 04:52:12 dovecot_plain authenticator failed for H=(minkless) [154.177.185.111]:41036: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-01-15 04:52:49 dovecot_login authenticator failed for H=([197.231.202.201]) [197.231.202.201]:46979: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-15 04:53:09 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:43957: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-15 04:53:11 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (wrestious) [73.144.27.228]:46816: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-15 04:57:36 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:48753: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2026-01-15 04:57:56 dovecot_login authenticator failed for H=([5.32.61.6]) [5.32.61.6]:53535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.46
country_id: 1210997
description:
2026-01-15 04:58:40 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.46]:52404: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 15 05:00:30 host2 sshd[821362]: User essenceceylontea from 141.94.22.51 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.223.92.208
country_id: 3175395
description:
2026-01-15 05:00:36 dovecot_login authenticator failed for H=(ADMIN) [176.223.92.208]:51990: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.13.8.139
country_id: 1269750
description:
Jan 15 05:10:58 host2 sshd[831227]: Disconnected from invalid user work 135.13.8.139 port 43788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-15 05:15:14 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:58367: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 15 05:14:39 host2 sshd[833849]: Disconnected from invalid user user 2.57.121.25 port 26137 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2026-01-15 05:15:52 dovecot_login authenticator failed for H=([149.54.62.58]) [149.54.62.58]:50448: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.17
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.131.17, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DCrauGFIVLItnIMR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:52 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<HbjxuGFIbcYtnIMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.19
country_id: 2264397
description:
Jan 15 05:16:53 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZjUDuWFIJ4UtnIMT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.131.18
country_id: 2264397
description:
Jan 15 05:16:57 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.156.131.18, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<dHNHuWFI64EtnIMS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.131.20
country_id: 2264397
description:
Jan 15 05:16:50 host2 dovecot[221878]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.131.20, lip=66.85.158.92, TLS, session=<qPbRuGFIB+ktnIMU>


